Security audit

税务月度自查包（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Chinese tax self-check helper that reads user-provided files and runs bundled deterministic checks without network use or persistence.

Install only if you need a local Chinese/China-tax monthly self-check workflow. It can process sensitive accounting data from files you provide, so review inputs before running it, and treat outputs as arithmetic/reconciliation checks rather than tax, audit, or filing advice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This is another manifestation of the same core issue: the free version is described as executing three tax checks, while the analyzer reports only one category is actually implemented. Because this skill is positioned for monthly accounting/tax verification, incomplete execution is operationally dangerous even without code execution or data exfiltration, since omissions in tax validation can directly lead to incorrect declarations or missed discrepancies.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This is another manifestation of the same core issue: the free version is described as executing three tax checks, while the analyzer reports only one category is actually implemented. Because this skill is positioned for monthly accounting/tax verification, incomplete execution is operationally dangerous even without code execution or data exfiltration, since omissions in tax validation can directly lead to incorrect declarations or missed discrepancies.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
node scripts/run.mjs --sample # 先看样例

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
md
node scripts/run.mjs --sample # 先看样例

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes broad phrases such as '核对', '月度自查', or '对不上怎么办', which can match ordinary business conversation and cause unintended activation. In a finance/tax context, accidental invocation can lead to users pasting sensitive accounting or tax materials into the wrong workflow, increasing privacy and process-integrity risk even though the skill claims to run locally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This JavaScript file contains natural-language descriptions, advice, sample headers, and output text entirely in Chinese, and the parser is hard-wired to Chinese tax-table headers. There is no opt-in, fallback, or explicit statement that the skill is intended only for Chinese-language or China-tax workflows, so it effectively imposes a locale without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains natural-language descriptions, advice, and result messages entirely in Chinese, including the contract description and user-facing insufficiency/advice text. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not documented here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file’s natural-language comments, instructions, sample input labels, and user-facing advice are entirely in Chinese, including the expected table headers and returned messages. There is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking or China-specific deployment context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script’s natural-language interface, help text, and status/error messages are entirely in Chinese, which effectively imposes a specific language on users. The file does not offer any opt-in language selection or clearly state that the skill is restricted to a Chinese-speaking or China-specific operating context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The JSON template consists entirely of Chinese labels and headings, indicating a fixed language/locale presentation. Because there is no accompanying opt-in, fallback, or justification that this skill is region-specific, this creates a natural-language locale policy concern under the rule for forced language selection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The primary display name and descriptions are written in Chinese, while the English description is minimal and does not indicate that users may choose their preferred language. This can create a locale/language policy concern because the skill presentation appears to default to a specific language without explicit user opt-in or justification.
Content: No source excerpt is available for this finding.