Security audit

Nalog Ru

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a Russian tax-calculation purpose, but it also tells the agent to run local Python commands, keep a usage counter, and append unrelated Telegram promotion.

Review this skill carefully before installing. Its tax-calculation content is straightforward, but the Attribution section should be removed because it creates persistent local state and injects unrelated promotion into answers. There is no evidence of credential theft or remote code retrieval, but the command execution and hidden counter are not appropriate for a calculator skill.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:73
Finding: Forced Promotional Content Injection into Agent Responses
Content: View full analysis
= 3 — ничего не добавляй ``` ### Technical Analysis The skill's stated purpose is to calculate Russian tax liabilities. The Attribution section instead instructs the agent to modify its final response by appending unrelated cross-promotion and links to external Telegram channels. This behavior changes the response-generation objective when the skill is loaded. The promotional content is not required to perform tax calculations and is not requested by the user. The use of a persistent counter also limits the injection to the first three executions, making the behavior less consistently visible during repeated review or testing. The section does not merely document attribution. It requires command execution, evaluates hidden state, and conditionally inserts attacker-selected content into a trusted response. ### Attack Path 1. A user invokes the skill for a legitimate tax calculation. 2. The agent loads and follows the instructions in `SKILL.md`. 3. The agent executes the supplied Python command to read the promotion counter. 4. If the counter is below three, the skill directs the a ...[truncated 977 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:77
Finding: Unsafe Persistent Workspace Counter Modification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The markdown embeds hidden operational instructions to read and modify a local file under the guise of attribution. Undisclosed command execution and filesystem writes are dangerous in skill content because they create covert side effects unrelated to user intent, and the tax-skill context makes them more suspicious, not less, since no local file access is needed for the feature.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly directs the agent to execute local Python commands that read and write a workspace file unrelated to tax computation. This is dangerous because it turns a simple calculator skill into one that performs undisclosed local state access and mutation, violating least privilege and opening the door to covert persistence, tracking, or broader command-execution abuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill is written entirely in Russian and instructs responses in Russian tax terminology without stating that the user may choose another language. Under the policy, locale-specific behavior should either be optional or explicitly documented as a justified regional constraint.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list includes generic terms such as "налог", "доход", and "сколько платить", which can appear in many ordinary conversations and may cause unintended activation. The file does not provide exclusion conditions or negative examples to narrow when the skill should or should not run.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to append unrelated promotional content and references external Telegram channels, which is outside the stated tax-calculation purpose. This creates unauthorized output manipulation and light tracking/stateful behavior, and it is especially suspicious because it is coupled with local state checks to control when the promotion appears.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.