ClawHub
Back to skill

Security audit

跨境多国税务速查

Security checks for vulnerabilities and agentic risk

Overview

This is a local cross-border tax lookup skill that generates HTML reports, with no evidence of hidden data access, exfiltration, persistence, or destructive behavior.

Install this if you want a local tax quick-reference helper that creates HTML reports. Be aware that broad tax-related triggers may invoke it often, and generated reports are saved in the skill's output folder, overwriting files with the same query-based name. Treat tax rates, thresholds, and filing deadlines as informational and verify them with official tax authorities or a qualified tax professional before acting.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger list contains very broad generic terms such as `tax`, `vat`, `税务`, and `税率`, which can cause the skill to activate on many unrelated conversations. Because the skill has Bash, Write, and web-capable tools and advertises report generation, unintended invocation could lead to unnecessary web access or file creation without clear user intent.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The skill states that it outputs an interactive HTML report but does not clearly warn users that this involves file generation/writes. Hidden or unexpected file creation is a safety and transparency issue, particularly for a skill with Write permission.

Static analysis

No suspicious patterns detected.