Security audit

Vaudtax

Security checks across malware telemetry and agentic risk

Overview

This skill handles Vaud tax files and includes sensitive local processing plus a disclosed, user-requested call to the official Vaud tax calculator.

Install only if you are comfortable letting an agent read sensitive tax data. Use the default redacted modes for normal summaries, avoid --full unless you need direct identifiers, delete extracted attachments after review, and use the calculator only when you accept sending the listed tax inputs to vd.ch.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill manifest says it is for working with local .vaudtax files, but this script adds a separate capability to contact an external government website. That creates an unexpected data egress path and expands the trust boundary beyond local file processing, which is dangerous for tax workflows because users may reasonably assume their declaration data stays local.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code sends taxable income, wealth, family-status, and commune data to a remote service via HTTP POST. For a skill presented as local .vaudtax processing, this is a meaningful confidentiality issue because sensitive financial data leaves the local environment without a scope-justified need.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document explicitly instructs users to use a script that sends tax inputs to the vd.ch server, but it does not warn that taxable income, fortune, family-status, and commune data will be transmitted off-device. In a tax-processing skill, these fields are sensitive financial and personal data, so omission of a clear disclosure can cause unintended exposure and privacy/compliance issues even if the destination is the official government service.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Although the destination uses HTTPS, the issue here is lack of explicit user-facing notice at the moment sensitive tax data is transmitted. Users handling .vaudtax files may not expect a local-analysis skill to disclose their financial data to a third-party service, so silent transmission undermines informed consent and privacy expectations.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The script writes a JSON export of tax-declaration data to disk, and the optional `--full` flag disables redaction for direct identifiers such as NAVS13, IBAN, phone, and email. Even though redaction is the default, exporting cleartext personal and financial data without an explicit confirmation, warning at write time, or restrictive file-permission handling increases the risk of accidental disclosure through shared directories, backups, or later reuse of the JSON file.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The extraction routine writes tax attachments containing highly sensitive personal and financial documents to a persistent directory on disk, including a temp directory when no output path is specified. Although this is user-invoked functionality rather than covert exfiltration, the script provides no clear warning, no restrictive permission handling, and no automatic cleanup, which increases the chance of unintended retention or exposure of confidential data.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The test is wired to a real personal tax declaration path under a private Dropbox directory and executes processing against that file when present. In a skill that handles sensitive tax records, embedding a real-user fixture path increases the risk of accidental processing, disclosure through logs or CI artifacts, and normalization of using production-like personal data in tests.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.