个税汇算清缴助手（Tax Assistant）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:56 AM UTC
• Version: 0.1.2

Overview

This China tax assistant is not malicious, but it handles sensitive tax records and filing decisions without enough privacy and verification safeguards.

Review before installing. Use it only if you are comfortable processing China tax information with the agent, prefer manual entry over screenshots, redact personal identifiers and unrelated details, and verify all income, deductions, prepayments, and filing choices against official records before submitting anything in the tax app.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:82

Finding

Mandatory Promotional Footer Hijacks Agent Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 82
Vulnerability Type: Mandatory output-content injection
Risk Level: Medium

Complete Vulnerable Snippet:

markdown

- 结尾附上工具信息：`Powered by tax-assistant`。

The instruction translates to: “Append the tool information Powered by tax-assistant at the end.”

Technical Analysis

The skill instructs the agent to append fixed promotional branding to its responses. This requirement is unrelated to the correctness of the tax calculation and alters the agent's final output whenever the skill is used.

Because this instruction is loaded as part of the skill definition, it persistently influences responses throughout the current skill session. It compromises output integrity by adding content that the user did not necessarily request. The behavior therefore best matches skill instruction hijacking.

Attack Path

1. The tax-assistant skill is loaded into an agent session.
2. The agent treats the interaction rules in SKILL.md as operational instructions.
3. A user requests tax analysis or filing guidance.
4. The agent generates the requested response.
5. The line 82 instruction causes the agent to append Powered by tax-assistant regardless of whether attribution was requested or relevant.

Impact Assessment

The issue does not grant operating-system privileges, access files, execute code, or expose credentials. Its scope is limited to the agent's generated output during sessions in which the skill is active.

An attacker or skill publisher can force unsolicited attribution into otherwise legitimate responses. This reduces user control over response content and may affect downstream systems that expect task-only output, strict schemas, or unmodified responses.

Remediation

View remediation

Remediation Suggestions

1. Remove the mandatory footer instruction from SKILL.md.
2. Do not require promotional, attribution, or unrelated fixed content in task responses.
3. If attribution is operationally necessary, make it optional and include it only when explicitly requested by the user.
4. Keep output requirements limited to information required for tax calculations, diagnostics, and filing guidance.
5. Add a review rule prohibiting skill instructions that force advertisements, endorsements, promotional links, or branding into user-facing output.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly requests tax-app screenshots and detailed income, deduction, and tax-payment data, which are highly sensitive personal and financial records. Without privacy warnings, minimization guidance, or redaction instructions, users may overshare information that could enable identity theft, financial profiling, or unauthorized disclosure.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

The skill hardcodes execution of a script from the agent configuration directory under ~/.gemini/config, a sensitive local path that may contain user- or environment-modifiable content. If that path or script is tampered with, the agent could execute unintended local code with access to the user's tax data, turning a tax helper into an arbitrary-code execution and data-exfiltration vector.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

获取数据后，你必须调用内部的决策计算脚本 tax_calculator.py，避免口算。 运行命令示例：

bash

python3 ~/.gemini/config/skills/tax-assistant/tax_calculator.py \
  --salary <工资薪金税前> \
  --labor <劳务报酬税前> \
  --manuscript <稿酬税前> \

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger condition is broad and purely keyword-based, so the skill may activate on incidental mentions of taxes and begin soliciting or processing sensitive financial data without strong user intent. In this context, unintended invocation increases privacy risk because the skill is designed to collect detailed tax and screenshot information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow gives step-by-step instructions to submit a tax filing in the app but does not require the user to verify imported figures, filing status, or source data before submission. That omission can lead to inaccurate declarations, penalties, delayed refunds, or accidental submission of an unfavorable tax treatment choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The instructions require the assistant to operate according to Chinese individual income tax law and produce a guide for the Chinese personal tax app, but they do not explicitly present this as a locale-specific skill or offer user choice of language/locale. Under the stated policy, forcing a specific locale without opt-in can be a natural-language policy issue unless clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code presents user-facing help text and later emits explanatory output strings entirely in Chinese, but provides no option to select another language or locale. Under the policy for natural-language constraints, forcing a specific language without user opt-in is a reportable issue.

Content

No source excerpt is available for this finding.