Security audit

Kazakhstan tax assistant

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Kazakhstan tax-law reference/search helper with opt-in document fetching and no hidden credential use or exfiltration behavior found.

Install only if you are comfortable with a skill that runs local Node.js scripts to search bundled legal texts and optionally fetch or update law files. Prefer the documented manual HTML download path; use --insecure only on a trusted network, and keep --file paths pointed at intended law documents rather than private local files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.insecure_tls_verification

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/_shared.mjs:113

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/_shared.mjs:113