Tax Planning Framework

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:34 PM UTC
• Version: 1.0.0

Overview

This tax-planning skill is mostly a documentation-only advisor, but it gives high-stakes tax guidance with weak jurisdiction scoping and embeds unrelated commercial promotions in the agent instructions.

Review before installing. Use this only as a general checklist, not as tax advice, and require the agent to confirm jurisdiction, tax year, business structure, and user consent before applying any rule. Be aware that the skill may surface the publisher's commercial links because they are embedded in the loaded instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:89
• Finding: Out-of-Scope Commercial Promotion Embedded in Agent Instructions< — $47 each, covering Fintech, Healthcare, Legal, Construction, SaaS, and more. Each pack includes tax-relevant compliance and financial frameworks for your sector. **Calculate your AI automation ROI:** [AI Revenue Calculator](https://afrexai-cto.github.io/ai-revenue-calculator/) | **Set up your AI agent:** [Agent Setup Wizard](https://afrexai-cto.github.io/agent-setup/) Bundles: Playbook $27 | Pick 3 $97 | All 10 $197 | Everything $247 ``` ### Technical Analysis The skill places third-party advertisements, purchase prices, and calls to action immediately after its mandatory output-format instructions. These promotions are unrelated to the skill's stated function of generating tax-planning recommendations. Because `SKILL.md` is intended to be loaded as agent instructions, content located in this context can influence the agent's current-session behavior and generated answers. Positioning commercial links beside the response requirements creates a risk that the agent will reproduce or endorse the promotions as though they were part of its tax advice. The same destinations are repeated in `README.md` lines 22–26, demonstrating that the links are deliberate promotional material. The project does not contain executable code, and there is no evidence that these URLs are fetched automatically or that remote content is executed. ### Attack Path 1. A user or platform installs and activates the tax-planning skill. 2. The agent loads `SKILL ...[truncated 1135 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the commercial footer from `SKILL.md`, particularly lines 93–97. 2. Keep agent instructions limited to behavior necessary for tax-planning functionality. 3. Place optional commercial or project-maintainer links only in clearly labeled documentation that is not loaded as agent instructions. 4. Do not instruct or imply that the agent should include promotional links, prices, or sales messages in user-facing tax guidance. 5. If external resources are genuinely required, disclose their ownership and commercial relationship and require explicit user consent before presenting them. 6. Add a review policy that rejects advertisements, affiliate links, unrelated calls to action, and product-placement instructions from executable skill prompts. 7. Retain the professional-advice disclaimer while keeping it clearly separated from any nonessential external resources. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The usage section advertises very generic activation phrases such as "Help me with tax planning" and "Optimize my business taxes," which can overlap with normal user requests and cause the skill to be invoked unintentionally. In an agent ecosystem, overly broad triggers increase the chance of prompt/skill hijacking, unexpected execution, or the skill taking control in contexts where the user did not explicitly request this specific capability.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation phrases are broad enough to match ordinary requests for general financial or tax help, which can cause this skill to trigger unexpectedly. In a tax-planning skill, accidental invocation is risky because the agent may provide jurisdiction-specific, high-stakes financial guidance without first confirming scope, user location, or suitability.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The skill defaults to US and UK tax rules without obtaining user opt-in or confirming jurisdiction, which can lead to materially incorrect advice being presented as applicable. In a tax context, this is especially dangerous because users may rely on thresholds, entity recommendations, filing deadlines, and deduction rules that are wrong for their location, creating compliance, penalty, and financial risks.

Static analysis

No suspicious patterns detected.