US Tax Return Review-1040

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:01 AM UTC
• Version: 1.0.0

Overview

This skill openly reviews user-provided tax-return JSON and writes local report files; its main risks are expected sensitive-data handling and an optional unpinned DOCX dependency install.

Install and run this only in a trusted, private workspace because generated reports can contain tax-return amounts and audit-risk details. Prefer a virtual environment with a pinned python-docx dependency, choose an output directory that is not broadly shared or synced, and delete generated artifacts when they are no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:74

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 74-78
Vulnerability Type: Unpinned runtime dependency installation
Risk Level: Medium

Vulnerable Code:

markdown

If `python-docx` is missing, install it:

```bash
python -m pip install --user python-docx

text

### Technical Analysis

The installation command retrieves the current `python-docx` package and its transitive dependencies from pip's configured package index without enforcing an audited version, a dependency lock file, or cryptographic hashes. The installed code can therefore differ between executions even when the Skill itself has not changed.

Although `python-docx` is a legitimate package and the audit found no evidence that it is currently malicious, this installation method creates a supply-chain risk. Compromise of the package publisher, package index, dependency resolution process, or a transitive dependency could cause attacker-controlled code to be installed. A malicious package could execute code during installation or when imported by `scripts/review_1040.py`.

### Attack Path

1. An attacker compromises a relevant package release, publisher account, configured package index, or transitive dependency.
2. A user follows the Skill's documented installation command because `python-docx` is unavailable.
3. Pip resolves and downloads mutable, unpinned package content from the configured index.
4. The compromised package is installed in the user's Python environment.
5. Malicious code executes during package installation or when `scripts/review_1040.py` imports `docx`.
6. The code runs with the privileges of the user executing pip or the review script.

### Impact Assessment

Successful exploitation could provide arbitrary code execution with the current user's privileges. The accessible scope may include files readable or writable by that user, generated tax-review artifacts, supplied tax-return data, environment variables,
...[truncated 462 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare python-docx in a reviewed dependency file and pin it to an explicitly approved version.
2. Lock all transitive dependencies rather than constraining only the top-level package.
3. Record cryptographic hashes and install with pip's hash verification:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Generate and review the lock file through a controlled dependency-management process.
5. Retrieve packages only from an approved package index or internal artifact repository.
6. Run dependency vulnerability and provenance checks before updating pinned versions.
7. Avoid encouraging ad hoc runtime installation in the Skill instructions. Instead, document a reproducible environment setup step performed before sensitive tax data is processed.
8. Execute the review in an isolated virtual environment or container with minimal filesystem and credential access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill describes and instructs execution of a local Python script that reads input files and writes multiple output artifacts, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a capability/permission mismatch: an agent or reviewer may not have clear boundaries on filesystem access, increasing the risk of over-broad file reads or writes when handling sensitive tax-return data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This script persists highly sensitive tax-return content, including filing status, dependent counts, income figures, payments, refunds, and audit-risk assessments, to local markdown/JSON/DOCX files by default. In a tax-review skill, writing this data to disk without explicit consent, destination validation, minimization, or protective controls materially increases the chance of unauthorized disclosure through shared workstations, synced folders, backups, or later exfiltration by other processes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.