Security audit

corporate-tax

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent corporate finance/tax helper, but it repeatedly allows sensitive financial and audit data to be read from or written to Notion without clear confirmation or privacy controls.

Review before installing if you plan to connect Notion or use real company records. Use least-privilege Notion access, confirm the exact database/page before any read or write, and avoid uploading full ledgers, bank statements, audit findings, employee/vendor details, or tax workpapers unless your organization has approved that external storage.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README states the skill can be triggered through natural conversation by 'saying your need' and automatically matching a sub-skill, which creates a broad activation surface. In a financial/tax skill handling accounting, tax, audit, and reporting workflows, ambiguous routing can cause accidental invocation of the wrong sub-skill and lead to inappropriate processing of sensitive financial data or incorrect compliance-oriented outputs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description advertises several highly generic trigger phrases such as everyday accounting/help requests, which makes accidental invocation more likely outside the intended context. Because the skill handles sensitive financial and tax workflows, broad activation can expose users to inappropriate guidance, incorrect calculations, or unnecessary solicitation of sensitive data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The routing logic uses substring-style keyword/scenario matching across broad business requests, which can invoke the wrong subskill without strong disambiguation. In a finance/tax skill, misrouting can lead to incorrect accounting, tax, or audit outputs being produced under the wrong workflow, increasing compliance and data-handling risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document mandates CAS as the governing standard and presents all operational instructions and trigger phrases exclusively in Chinese, but does not state that the skill is intentionally limited to a China-specific locale or offer any user opt-in for this constraint. Under the language/locale policy, forcing a specific locale without clear justification or choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file is written as a Chinese-language skill for preparing financial statements under CAS, and it does not indicate that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill directs users to send audit reports and remediation tracking data to Notion, but does not warn that these materials may contain sensitive financial, control, personnel, or investigation details being transmitted to a third-party SaaS. In an internal-audit context, this omission is more dangerous because audit outputs often include confidential findings, control weaknesses, and potentially allegation-related content, so users may disclose regulated or highly sensitive data without an informed decision.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The execution flow explicitly instructs writing the full audit report and each remediation item into Notion without any privacy, confidentiality, or third-party sharing notice. Because this is not a generic document workflow but an internal-audit workflow, the uploaded content can expose control deficiencies, compliance gaps, financial issues, or fraud-investigation details to an external platform contrary to organizational policy or legal requirements.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This skill explicitly handles highly sensitive financial artifacts such as bank statements, invoices, reimbursement forms, and accounting vouchers, and also supports writing outputs to an external Notion workspace. Without clear privacy guidance, data minimization rules, consent checks, redaction expectations, or warnings about third-party transmission, users may expose regulated financial, employee, supplier, and tax data to unnecessary processing or external storage.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file title and descriptive text are entirely in Chinese and present the reference as the internal basis for the related skill's output, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly supports writing month-end closing checklists and progress data into Notion, but it does not require user confirmation, data minimization, or any warning that sensitive financial workflow information may be sent to a third-party SaaS. In a corporate tax/accounting context, even progress tables can contain confidential operational and financial details, so silent transmission increases the risk of unintended data disclosure and compliance issues.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes this skill suite as handling corporate tax/accounting tasks such as voucher preparation, VAT management, closing checklists, tax settlement, financial analysis, and reporting. While VAT analysis itself is in scope, explicit web-search capability to query external sources is not declared in the manifest and introduces a broader capability than the stated business-function description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly states it can write tax adjustment reports and filing workpapers into Notion, but it does not include a user-facing consent or confirmation step before modifying an external workspace. In a finance/tax context, this creates a real integrity and confidentiality risk because generated workpapers may contain sensitive financial data and could be written to the wrong page, database, or workspace if the connector is mis-scoped or the user intent is ambiguous.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly supports writing budget analysis reports and action items into Notion, which can modify external workspace content, but it does not instruct the agent to obtain explicit user confirmation or to clearly distinguish read-only analysis from write actions. In a corporate finance context, silent or assumed writes could create unauthorized records, expose sensitive business data to a wider audience, or clutter production workspaces with incorrect action items.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: 文档说明“本技能基于企业会计准则（CAS）报表结构进行分析”，整体内容也默认使用中文语境与中国财报口径，但未提供用户选择其他准则或明确限制为中国企业场景的更强约束。按规则，强制特定语言/locale 或地区口径而无用户 opt-in 可能构成自然语言政策问题。
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill explicitly supports writing financial analysis reports into Notion, but it does not clearly require user confirmation at the moment of export or warn that potentially sensitive financial data will be transmitted to and stored in a third-party service. In a corporate finance context, this can cause unintended disclosure of confidential business information, especially if the agent auto-writes full reports containing internal financials.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file consistently specifies the skill in Chinese, including headings, instructions, and output templates, with no indication that users may select another language. This can violate language/locale policy where tools should not force a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill states it can write VAT analysis reports and filing workpapers into Notion, but it does not require explicit user confirmation before modifying an external workspace. In a finance context, this can expose sensitive tax data, create unauthorized records, or overwrite internal documentation in systems used for compliance and audit.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill reads input VAT/output VAT ledger data from a Notion database without warning that these records may contain sensitive financial and tax information. Because VAT ledgers can include transaction details, counterparties, and invoice data, silent access increases the risk of over-collection, privacy violations, and unintended exposure of regulated business information.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.