法国个人所得税计算服务

• Outcome: Review
• Latest audit: Jul 3, 2026 · 12:55 PM UTC
• Version: 1.0.1

Overview

This tax skill appears purpose-related rather than malicious, but it asks for and persists an API key while sending sensitive tax inputs to a third-party API with limited disclosure and weak scoping.

Install only if you are comfortable using xiaobenyang.com as a third-party tax-data processor and storing its API key in a local plaintext .env file. Avoid entering unnecessary personal tax details, and remove the saved XBY_APIKEY when you no longer use the skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation describes capabilities that imply access to environment variables, local file read/write, and network operations, yet no permissions are declared. This creates a transparency and consent failure: a user may believe they are invoking a simple tax calculator while the skill can persist secrets and make outbound requests. In a finance/tax context, undeclared access is more dangerous because inputs may include sensitive financial data and API credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is a French income tax calculator, but the documented behavior includes broad web retrieval, legal search, report generation, cached data access, and persistent API key storage. This mismatch can mislead users and security reviewers about the real data flows and trust boundaries, increasing the risk of oversharing sensitive tax questions or credentials to external services. The inclusion of local API key persistence further elevates impact beyond a simple calculator.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill presents itself as a tax calculation service but actually exposes a much broader tax research and report-generation interface. That expansion is security-relevant because users may provide more personal financial context than necessary, and the agent may route that data into functions the user did not expect. In a tax domain, scope expansion increases privacy and compliance risk.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The workflow example references unrelated gaokao/school-search code paths while the skill claims to be for French income tax. This inconsistency is a red flag for copy-paste errors, hidden inherited functionality, or poor maintenance, all of which undermine trust in the documented behavior and may cause the wrong tools or APIs to be invoked. In security terms, documentation/code confusion can conceal unintended data handling paths.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This file implements a generic remote MCP tool invoker rather than a narrowly scoped French income-tax calculator. In a skill advertised for tax computation, this creates capability mismatch: the component can be used to call arbitrary upstream tools, increasing the attack surface and enabling unintended actions if other parts of the skill pass attacker-controlled tool names or parameters.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The call_tool method accepts arbitrary mcp_id, tool_name, and params and forwards them directly to a remote API, effectively exposing a generic remote execution/invocation primitive. In the context of a tax-calculation skill, this is especially risky because the declared business purpose does not justify broad tool dispatch, so misuse could trigger unrelated sensitive upstream operations or data access.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill implements storage and management of an external API credential even though the advertised purpose is only French income tax calculation. This capability expands the trust boundary and creates secret-handling risk without clear user justification, increasing the chance of credential leakage or misuse.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Writing API secrets into a local .env file creates a persistent plaintext secret on disk. For a tax calculator skill, this behavior is not clearly necessary and can expose credentials through backups, repo accidents, local compromise, or multi-user environments.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill is described as a personal income tax calculator, but it exposes additional capabilities for legal article lookup, procedural guidance, web retrieval, and report generation. This scope expansion increases the attack surface and can enable unintended use of the skill for broader data retrieval or document-generation workflows beyond the user’s expected purpose.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The report-generation function accepts an optional output file path despite the skill being presented as a tax calculation service. File-output capability is higher risk than simple calculation because, if the downstream API honors arbitrary paths or writes sensitive tax content to disk, it could enable unauthorized file creation, overwriting, or persistence of personal financial data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to ask the user for an API key and persist it via set_api_key, but it does not clearly warn that the key will be stored locally. Users may disclose a sensitive credential believing it is used transiently, when in fact it is written to persistent storage, creating risk of later leakage through filesystem access, backups, logs, or multi-tenant reuse. Secret-handling opacity is especially dangerous in agent skills.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill description omits that tax queries and related financial context may be sent to external web or API services. Users may assume a local calculation workflow, but the documented tools include outbound requests to third-party and government websites, which changes the privacy exposure of their data. In a tax-assistance context, even seemingly routine queries can reveal sensitive financial circumstances.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code persists the API key to disk without any explicit warning, confirmation, or visible user control. Silent persistence of secrets is dangerous because users may believe a key is used temporarily while it actually remains recoverable on the system.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The wrapper forwards tax-related user inputs to an external API via call_api without any visible disclosure, minimization, or consent controls in this file. Because tax topics, income values, and household composition are sensitive financial data, silent transmission to a remote service creates privacy and compliance risk if users are unaware or if logging/retention occurs downstream.

Credential Access

High

• Category: Privilege Escalation

Content

default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")

• Confidence: 88% confidence
• Finding: The code forcibly reads .env manually to extract a specific API key, bypassing normal settings handling and increasing secret-processing complexity. This custom parsing makes secret access less transparent, easier to misuse, and harder to audit, especially in a skill whose declared purpose does not imply secret management.

Credential Access

High

• Category: Privilege Escalation

Content

def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():

• Confidence: 88% confidence
• Finding: Opening and reading the .env file directly for secret extraction increases the surface for mishandling plaintext credentials. In this context, direct secret-file access is more dangerous because the skill description does not prepare users for local credential inspection and persistence behavior.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 95% confidence
• Finding: This function is explicitly designed to save an API key into a local .env file, creating persistent plaintext secret storage. That is risky because local files are often exposed through backups, debugging artifacts, shared systems, or accidental commits.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 94% confidence
• Finding: The API key setter intentionally persists the supplied credential to disk as part of normal operation. This couples routine configuration with durable secret storage, which is unsafe for a user-facing skill unless strongly justified and clearly disclosed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: The dependency is specified with a lower-bound version only, which allows future installs to resolve to different versions over time. This weakens build reproducibility and can unintentionally pull in vulnerable or breaking releases, increasing supply-chain risk for the service.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: Using an unpinned minimum version for pydantic means deployments may install different package versions depending on when and where the environment is built. This can introduce unreviewed code changes or vulnerable releases and makes security response and debugging harder.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: The package version is not fixed, so dependency resolution may drift and produce non-reproducible environments. In a service that may be deployed repeatedly, this raises supply-chain exposure because a later install could fetch a compromised or incompatible release.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: A lower-bound-only requirement for python-dotenv permits installation of varying future versions and undermines reproducibility. That increases the chance of unexpectedly introducing a vulnerable version or behavior change into the tax-calculation service.

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: The requirements allow installation of requests 2.31.0, and the finding identifies multiple advisories affecting that version. Because this skill is described as dynamically fetching tax bracket information, an HTTP client vulnerability is more relevant than in an offline-only tool and could expose credentials, weaken request verification, or otherwise compromise network interactions depending on usage.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The file permits python-dotenv 1.0.1, which is flagged for a symlink-following arbitrary file overwrite issue in set_key. This is only exploitable if the skill or its operational tooling invokes dotenv file-writing functionality on attacker-influenced paths, so the dependency risk is real but the direct impact from this file alone appears limited.

Static analysis

No suspicious patterns detected.