税务口径卡

• Outcome: Pass
• Latest audit: Nov 3, 2026 · 4:46 PM UTC
• Version: 0.1.0

Overview

The skill coherently summarizes tax-policy documents, with disclosed optional online services and no hidden access or persistence found.

Use supplied text without Cue if you want to avoid the optional external services. Before enabling them, review the separate dependencies, verify credential destinations, and check document-sharing, retention, and billing terms. Keep confidential material out of external parsing unless you authorize that disclosure. Prefer reviewed installer versions and repository revisions, and verify quoted rates and dates against the original document.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code contains no tax-document parsing, eight-category extraction, source anchoring, or missing-field reporting. Its demonstrated purpose is MCP catalog discovery and authenticated tool enumeration. These network operations are not shown supporting the declared tax-document workflow and constitute a materially different capability. The snippet only lists tools; it does not demonstrate invoking them or accessing tax records.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied chunk performs service discovery and connectivity diagnostics rather than reading tax documents or producing the declared eight-part summary. Although network access could support a tax-document workflow, this chunk establishes no such connection: it only retrieves a catalog and enumerates tools. The mismatch is the observable operational purpose, not merely the use of HTTP or an API key. There is no evidence here of tax analysis, source anchoring, or the declared missing-information handling.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 27)May include surrounding context.

3. Install and run

bash

mkdir -p ~/.workbuddy/skills
cp -r tax-policy-card-cn ~/.workbuddy/skills/
# ask the agent for the five-section card defined in SKILL.md, save it as my-tax-card.md
python3 ~/.workbuddy/skills/tax-policy-card-cn/scripts/check_tax_card.py ./my-tax-card.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

bash

# 1. 放到技能目录
mkdir -p ~/.workbuddy/skills
cp -r tax-policy-card-cn ~/.workbuddy/skills/

# 2. 让 agent 按 SKILL.md 的税务卡五段出卡，产物存成我的税务卡.md

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command leaves both the npx installer version and the skill repository revision unpinned. Although this is an installer rather than an MCP server reference, a compromised or unexpectedly changed upstream release could execute code or install altered agent instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The optional dependency installation uses an unversioned npx executable and a mutable repository reference. Installing the collection can introduce upstream code and agent instructions that were not part of the reviewed tax-card skill.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Selecting a single skill narrows installation scope but does not pin the npx executable or repository revision. A compromised upstream release could therefore introduce executable code or credential-accessing instructions through an otherwise legitimate optional integration.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The tools/list request is ordinary authentication, not evidence of intentional exfiltration. However, the instructions send a bearer credential to a catalog-supplied URL without requiring HTTPS or validating the destination against an independently trusted service policy, so a malicious or compromised routing entry could capture the key.

Content

Scanner excerpt · README.en.md (reported line 55)May include surrounding context.

2) take routing.url and transport for the domain from the response; never hard-code the host

3) with the key, send tools/list - proves that endpoint accepted the key, nothing else

curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400

text

The troubleshooting workflow instructs users to start third-party attachment parsing without warning about document disclosure.

Medium

• Category: Output Handling
• Confidence: 86% confidence

Finding

The troubleshooting step recommends external attachment parsing without warning that document content may leave the user's environment. Public tax notices reduce the usual exposure, but user-supplied attachments can contain confidential annotations or taxpayer information, and this source does not establish the parser's retention behavior.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command does not pin either the npx installer or the tax-card repository revision. This is a supply-chain weakness rather than specifically an unpinned MCP server: upstream changes could execute code or persist altered agent instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The collection installer executes an unversioned CLI and retrieves skills from a mutable repository reference. Interactive selection limits which skills are installed, but it does not protect against compromised installer releases or altered selected skills.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The single-skill command still leaves both the installer executable and dependency source unpinned. Selecting cue-data-mcp or cue-omni-reader does not prevent upstream changes from introducing code or instructions with access to subsequently configured credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

Sending the API key to the intended service for tools/list is legitimate, but the workflow takes the destination from live routing data without specifying endpoint validation. A compromised catalog or incorrectly supplied routing URL could direct the bearer key to an attacker-controlled or insecure endpoint.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

2) 域路由现值：从返回里取该域的 routing.url 与 transport，别把域名抄死

3) 带 key 实连后发 tools/list——只证该数据腿端点被接受，不证别的入口

curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400

text

The recovery workflow instructs attachment parsing through Cue without warning that document contents may be sent to a third-party service.

Medium

• Category: Output Handling
• Confidence: 91% confidence

Finding

The recovery step directs users toward external attachment parsing without explaining the associated disclosure of document contents. Most official notices are public, but private attachments or annotations could expose sensitive taxpayer information; the statement that this skill does not persist documents does not establish the external service's retention policy.

Content

No source excerpt is available for this finding.

The attachment-parsing workflow lacks a privacy warning about sending document contents to an external service.

Medium

• Category: Output Handling
• Confidence: 91% confidence

Finding

The operational instructions route long attachments and PDFs through an external parsing channel without a privacy warning or explicit approval requirement. Restricting parsing to needed quotations reduces unnecessary processing, but does not prevent disclosure of confidential material in user-supplied documents; reporting parser use afterward is not prior consent.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The attachment-parsing workflow lacks a warning that document content may be sent to an external service.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The workflow directs attachment and PDF parsing through an external service without requiring an explicit disclosure or authorization before document content is transmitted. Although official policy documents are often public, user-supplied tax attachments can contain confidential annotations or taxpayer information; possessing an API key does not establish consent to disclose those contents.

Content

No source excerpt is available for this finding.