税务月度自查包（免费版）

• Outcome: Pass
• Latest audit: Sep 20, 2026 · 2:12 PM UTC
• Version: 1.0.47

Overview

This skill is a local Chinese tax self-check helper that reads user-provided files and runs bundled deterministic checks without network use or persistence.

Install only if you need a local Chinese/China-tax monthly self-check workflow. It can process sensitive accounting data from files you provide, so review inputs before running it, and treat outputs as arithmetic/reconciliation checks rather than tax, audit, or filing advice.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This is another manifestation of the same core issue: the free version is described as executing three tax checks, while the analyzer reports only one category is actually implemented. Because this skill is positioned for monthly accounting/tax verification, incomplete execution is operationally dangerous even without code execution or data exfiltration, since omissions in tax validation can directly lead to incorrect declarations or missed discrepancies.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is another manifestation of the same core issue: the free version is described as executing three tax checks, while the analyzer reports only one category is actually implemented. Because this skill is positioned for monthly accounting/tax verification, incomplete execution is operationally dangerous even without code execution or data exfiltration, since omissions in tax validation can directly lead to incorrect declarations or missed discrepancies.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 先看样例

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad phrases such as '核对', '月度自查', or '对不上怎么办', which can match ordinary business conversation and cause unintended activation. In a finance/tax context, accidental invocation can lead to users pasting sensitive accounting or tax materials into the wrong workflow, increasing privacy and process-integrity risk even though the skill claims to run locally.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This JavaScript file contains natural-language descriptions, advice, sample headers, and output text entirely in Chinese, and the parser is hard-wired to Chinese tax-table headers. There is no opt-in, fallback, or explicit statement that the skill is intended only for Chinese-language or China-tax workflows, so it effectively imposes a locale without user choice.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This code file contains natural-language descriptions, advice, and result messages entirely in Chinese, including the contract description and user-facing insufficiency/advice text. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not documented here.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file’s natural-language comments, instructions, sample input labels, and user-facing advice are entirely in Chinese, including the expected table headers and returned messages. There is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking or China-specific deployment context.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The script’s natural-language interface, help text, and status/error messages are entirely in Chinese, which effectively imposes a specific language on users. The file does not offer any opt-in language selection or clearly state that the skill is restricted to a Chinese-speaking or China-specific operating context.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The JSON template consists entirely of Chinese labels and headings, indicating a fixed language/locale presentation. Because there is no accompanying opt-in, fallback, or justification that this skill is region-specific, this creates a natural-language locale policy concern under the rule for forced language selection.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The primary display name and descriptions are written in Chinese, while the English description is minimal and does not indicate that users may choose their preferred language. This can create a locale/language policy concern because the skill presentation appears to default to a specific language without explicit user opt-in or justification.

Static analysis

No suspicious patterns detected.