T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_shared.mjs:108- Finding
Process-Wide TLS Certificate Verification Disabled for Authoritative Legal Downloads
- Content
View full analysis
- Remediation
View remediation
Security audit
Kazakhstan tax assistant
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed Kazakhstan tax helper, but its scripts can read or overwrite broader local files and can update legal data through insecure downloads.
Install only if you are comfortable treating it as a local legal-text helper, not a professional tax authority. Do not let untrusted prompts choose --file, --out, --html, or --insecure arguments; keep file paths inside the skill's data directory, prefer manually saved and verified HTML from adilet.zan.kz, and verify important tax answers against official sources before acting on them.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/search.js:187- Finding
Arbitrary Readable Local Files Can Be Searched and Disclosed Through Standard Output
- Content
View full analysis
0, results, ...(externalHints ? { externalHints } : {}), }, null, 2)); ``` ### Technical Analysis The `--file` option accepts absolute paths and relative paths outside the Skill’s data directory. No canonicalization, approved-root check, file-type restriction, or symbolic-link check is applied. The script reads the selected file using the full privileges of the Node.js process. Search results, matching paragraphs, surrounding context, and—in article mode—full article-shaped blocks are serialized to standard output. In an agent environment, standard output commonly returns to the model and can subsequently be exposed to a requesting user. This is not direct network exfiltration: `scripts/search.js` contains no network request. Therefore, the static pre-scan warning about sending sensitive data over the network is a false positive. The actual issue is a local disclosure primitive that may become externally visible through the surround ...[truncated 1323 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/fetch.js:32- Finding
Caller-Controlled Output Path Allows Overwriting Arbitrary Writable Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (30)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented maintenance features fetch remote content, update on-disk corpora, and modify version metadata, which materially differs from the declared purpose of answering tax questions. In context, this is dangerous because users or orchestration logic may invoke the skill expecting safe retrieval while it can perform side effects and ingest untrusted remote data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented maintenance features fetch remote content, update on-disk corpora, and modify version metadata, which materially differs from the declared purpose of answering tax questions. In context, this is dangerous because users or orchestration logic may invoke the skill expecting safe retrieval while it can perform side effects and ingest untrusted remote data.
- Content
Ae5
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Instruction-capable artifact exceeds whole-file semantic analysis limits
- Content
Ae5
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Instruction-capable artifact exceeds whole-file semantic analysis limits
- Content
Ae5
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Instruction-capable artifact exceeds whole-file semantic analysis limits
- Content
Ae5
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Instruction-capable artifact exceeds whole-file semantic analysis limits
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file explicitly states the tax code has lost force and is outdated, while the skill metadata claims to use the current edition. In a tax assistant, this is dangerous because users may receive incorrect legal guidance, rates, filing obligations, or compliance advice, causing financial loss, reporting errors, or regulatory violations.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The --file parameter is resolved relative to the workspace CWD and passed directly to readFileSync with only an existence check, allowing the skill to read arbitrary files from the workspace. In an agent setting, this can expose unrelated sensitive data such as secrets, prompts, source code, or user documents, far beyond the tax-assistant purpose.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger scope claims applicability to 'any tax question', but the actual corpus is limited to the tax code and a few related laws. Overbroad routing can send unrelated or high-stakes tax/compliance questions to a tool that may respond from an incomplete corpus, potentially causing incorrect advice or unnecessary execution of its auxiliary workflows.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file states that language is determined automatically from the request content and that explicit language selection is unnecessary. This imposes a locale/language behavior without user opt-in, which can mis-handle bilingual or preference-sensitive users and fits the language-policy violation category.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This file presents all content only in Kazakh and does not indicate that the skill is region-specific or that users can choose another language.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill content is presented exclusively in Russian, and there is no surrounding instruction offering users a language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill description promises Russian and Kazakh support, but this file is entirely Russian and offers no user-choice mechanism or equivalent Kazakh source in the analyzed artifact. In a legal/tax context, language asymmetry can mislead users, degrade accessibility, and increase the risk of misunderstanding compliance-critical obligations, especially for Kazakh-language queries.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The code forces requests to use only "kaz" or defaults everything else to "rus", which is a locale constraint embedded in logic rather than offered as a user choice. Under the policy, language or locale restrictions should be opt-in or clearly documented as region-specific; this file contains no such justification.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The helper exposes a code path that disables TLS certificate validation globally by setting NODE_TLS_REJECT_UNAUTHORIZED=0. That makes HTTPS requests vulnerable to man-in-the-middle interception and tampering, which is especially risky here because the skill fetches legal/tax content from a remote government-related site and could ingest falsified statutes or rules.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Setting NODE_TLS_REJECT_UNAUTHORIZED to 0 disables certificate verification for TLS connections, weakening transport security for the entire Node.js process. An attacker on the network path could spoof the remote server, alter downloaded legal content, or capture sensitive traffic, and the tax-assistant context makes content integrity important because users may rely on the returned legal guidance.
- Content
js export function applyInsecure(insecure) { if (insecure) { console.warn("⚠️ --insecure: проверка TLS отключена. Используйте только в доверенной сети."); process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"; } }
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes a skill focused on answering tax questions about the Kazakhstan Tax Code, KGD rules, rates, deductions, and specific tax declarations. The script documentation explicitly says it can download 'any document' from adilet.zan.kz and lists non-tax laws such as budget, health insurance, social insurance, and pension statutes, which broadens the implemented scope beyond the stated tax-focused purpose.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The '--insecure' mode explicitly enables less secure network retrieval for remote HTML fetching, which can expose the process to man-in-the-middle tampering if used on untrusted networks. Because the fetched content is then parsed and written into the skill’s knowledge base as Markdown, an attacker could poison source documents and cause downstream misinformation or prompt/data contamination.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content