vietnam-invoice

越南发票验真 - 识别发票信息并通过越南税务 API 查验真伪

This skill implements the declared task, but be aware of several risks before installing/using it: - Manifest mismatch: the registry lists no required env vars, but the SKILL.md and code require VL_API_KEY, CJY_USER, and CJY_PASS. Expect to set sensitive credentials for operation. - Data leakage: the skill uploads full invoice images (base64) to an external VL/model endpoint and sends captcha images to a third‑party captcha solver (ChaoJiYing). If invoices contain PII or confidential tax numbers, those will be transmitted to those services. Only use with data you are comfortable sharing with those providers. - Credential handling: CJY uses account+password (not an API token); avoid reusing high-privilege credentials. Prefer accounts with minimal privileges and rotate credentials if exposed. - Environment/setup: the skill requires Playwright and an msedge browser install, plus PyMuPDF/Pillow — run in an isolated environment (container/VM) if possible. - Trust & provenance: the skill's source/homepage is unknown. If you will process real invoices, request provenance from the author or prefer an officially supported tool. Review the code yourself (or have a trusted reviewer) before supplying credentials. What would increase confidence: author/source verification, corrected registry metadata declaring required env vars, and explicit user-facing warnings that images and data are sent to the VL provider and ChaoJiYing (with option to disable external services or use local OCR).

Type: OpenClaw Skill Name: vietnam-invoice Version: 1.0.0 The skill is a legitimate tool for verifying Vietnamese invoices by extracting fields via a Vision-Language model (Alibaba Cloud Bailian) and querying the official Vietnamese tax portal (hoadondientu.gdt.gov.vn). It utilizes the Chaojiying service for captcha recognition and Playwright for rendering SVG captchas. While it disables SSL verification for requests and requires external API keys (CJY_USER, CJY_PASS, VL_API_KEY), these actions are consistent with its stated functionality, and no evidence of malicious intent, data exfiltration, or unauthorized execution was found in scripts/verify_vl.py or skill.md.