税费自查与优惠技能包（免费版）

• Outcome: Pass
• Latest audit: Sep 20, 2026 · 2:11 PM UTC
• Version: 1.0.21

Overview

This is a local Chinese tax worksheet checker that reads user-selected materials and reports arithmetic issues without network access, writes, persistence, or hidden behavior.

Install only if you are comfortable giving the skill local access to the tax worksheets or customer folders you explicitly pass to it. Treat results as arithmetic and reconciliation checks, not tax advice, and pay attention to items marked not run or sub-checks not run before relying on a clean result.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The mismatch between '5-item, per-client, no-payment' marketing and a narrower single-topic/monthly/free-subset implementation can cause users to treat absent findings as proof of compliance. In this context, the lack of original file references and customer-level conclusion lines further increases the chance of auditability gaps and mistaken reliance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The mismatch between '5-item, per-client, no-payment' marketing and a narrower single-topic/monthly/free-subset implementation can cause users to treat absent findings as proof of compliance. In this context, the lack of original file references and customer-level conclusion lines further increases the chance of auditability gaps and mistaken reliance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The mismatch between '5-item, per-client, no-payment' marketing and a narrower single-topic/monthly/free-subset implementation can cause users to treat absent findings as proof of compliance. In this context, the lack of original file references and customer-level conclusion lines further increases the chance of auditability gaps and mistaken reliance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The mismatch between '5-item, per-client, no-payment' marketing and a narrower single-topic/monthly/free-subset implementation can cause users to treat absent findings as proof of compliance. In this context, the lack of original file references and customer-level conclusion lines further increases the chance of auditability gaps and mistaken reliance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The mismatch between '5-item, per-client, no-payment' marketing and a narrower single-topic/monthly/free-subset implementation can cause users to treat absent findings as proof of compliance. In this context, the lack of original file references and customer-level conclusion lines further increases the chance of auditability gaps and mistaken reliance.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单客户样例（内置，5 项全跑）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单客户样例（内置，5 项全跑）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单客户样例（内置，5 项全跑）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --sample # 单客户样例（内置，5 项全跑）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest describes a broader cross-client tax material review covering five tax/fee categories and returning one conclusion per client with original document references. In contrast, this code accepts only a pasted '滞纳金计算表' text table, runs late-fee arithmetic consistency checks, and returns row-level findings for that one topic only.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file-level comments and all user-facing instructional text are written exclusively in Chinese, including required input guidance and disclaimers. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified as region-specific or optional.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The header documentation states that when materials are insufficient, the tool gives no conclusion. However, after passing the minimal table/header checks, the code continues processing rows with missing key fields and emits '空白字段' and other findings instead of treating the input as wholly insufficient.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s natural-language comments, instructions, sample input, and user-facing messages are entirely in Chinese, including the expected input guidance and returned advice/disclaimer strings. There is no indication that the skill is region- or locale-specific by policy, nor any opt-in or alternative language path, so this creates a language/locale policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The file’s user-facing comments, labels, prompts, and output strings are all written in Chinese, including required input guidance and result messages. There is no indication that the skill is region-specific by policy or that users may opt into another language, which creates a natural-language locale policy concern.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The disclaimer states the tool performs reference-rate deviation checks, but the implementation explicitly withholds those checks and only appends them to checks_not_run. This can mislead downstream users or agents into believing additional tax-risk validation occurred, creating a false sense of assurance and potentially causing material omissions in financial or compliance review.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file’s top-level description, contract guidance, sample headers, and advice strings are all written in Chinese, and the parser only recognizes Chinese table headers such as 「销售额」「销项税额」「进项税额」. There is no natural-language indication that users may choose another language or locale, nor any documented justification that the skill is intended only for a Chinese-region workflow.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code's comments, guidance, error messages, findings, and disclaimers are entirely in Chinese, which constitutes a natural-language locale constraint visible to users. There is no indication of user opt-in, alternative locale support, or an explicit justification that the skill is intended only for a Chinese-language or China-specific deployment.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The natural-language comments and user-facing contract/disclaimer text are written entirely in Chinese, effectively constraining the skill to a specific language audience without offering any user choice or opt-in. Under the policy, forcing a specific language without explicit opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The only natural-language content in this manifest-style JSON is entirely in Chinese, including section headings and field labels, with no indication that language selection is optional or limited to a China-specific compliance context. This can violate the language/locale policy because it effectively constrains the skill's interaction format without user opt-in.

Static analysis

No suspicious patterns detected.