T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/bookkeeping.py:43- Finding
Bookkeeping Records Stored in Plaintext with Inherited File Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
TaxWise — 智能财税
Security checks for vulnerabilities and agentic risk
Overview
This looks like a legitimate China-focused tax and bookkeeping helper, but it needs Review because sensitive financial records are stored locally in plaintext and some scoping/documentation does not match the code.
Install only if you are comfortable with financial records being kept as a local plaintext JSON file in the skill directory. Do not rely on the period filters for limiting what gets analyzed, review delete actions before running them, and treat all tax calculations as rough references rather than filing-ready advice.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description presents a comprehensive SME finance-and-tax skill with multiple free and premium capabilities. However, the actual code only performs one narrow function: mock invoice recognition/formatting. Even within invoice OCR, it does not perform real OCR; it returns simulated data based on the filename and optionally notes that real API integration is not implemented. There are no undeclared sensitive permissions or suspicious resource accesses beyond local file existence checks, but the primary purpose is materially narrower than the declared skill scope. Therefore this is a description-to-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a broad intelligent财税 skill for SMEs with both free and premium features, but the supplied code implements only a tax-rate query utility. It contains static tax tables and formatting/output logic; it does not perform invoice recognition, bookkeeping, filing, analysis, compliance review, planning, reimbursement handling, or financial statement generation. The only clearly supported part of the description is 税率查询 for certain taxes. This is a material description-behavior mismatch because the primary purpose in code is much narrower than the declared skill scope.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documents scripts that read and write local files, but it does not declare any tool scope or permissions boundary. That creates a mismatch between expected and actual capabilities, increasing the risk of unintended file access or unsafe execution in hosts that rely on manifest-declared constraints.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list is extremely broad and can activate on many common finance-related terms, causing the skill to be invoked outside clear user intent. In a finance/tax context, accidental activation is more dangerous because it can surface sensitive bookkeeping, invoice, or tax-filing workflows when the user may have intended only a general discussion.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains natural-language strings that force a specific language/locale experience. Under the policy, locale constraints should either be optional for the user or clearly justified as region-specific; here the script does not provide opt-in or explain the restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains user-facing natural-language documentation entirely in Chinese, including the tool name, usage, and feature description. The file does not offer any language choice or explain that the skill is intentionally region-specific, which conflicts with the policy against forcing a specific language without user opt-in.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
模块说明和 CLI 参数都表明用户可以通过 --period 指定分析期间（L003、L223），但 generate_report 在实现中没有使用传入的 period 参数过滤 records，而是遍历所有月份并生成全量分析。该行为与技能/脚本对外宣称的按期间分析能力不一致。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The formatted report strings and argparse descriptions are all hardcoded in Chinese, making the runtime experience language-locked. There is no flag, environment setting, or documented opt-in that lets users choose another language, and no explicit justification for the locale restriction.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
L214 的输出文案明确宣称完整版可生成利润表、资产负债表和现金流量表，但本文件实现的 report 仅包含汇总、月度分析、税负和环比数据，没有任何资产负债表或现金流量表生成逻辑。该文案与当前代码行为形成直接意图层面的不一致。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file's user-facing docstring, CLI help text, argument names, and output messages are all hardcoded in Chinese, with no indication that another language is supported or that the locale restriction is optional. This is a natural-language policy issue because the skill imposes a specific language on users without opt-in or a documented region-specific justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file's user-facing docstring, argument names, descriptions, and output are entirely in Chinese, and even exposes a non-English CLI flag (
--纳税人类型) without offering any language or locale alternative. This is a natural-language policy concern because the skill imposes a specific language on all users rather than providing opt-in or documenting a justified region-specific constraint.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This code file contains natural-language behavior that forces a specific language/locale: the module docstring, argument names, help text, and output strings are all Chinese. Under the policy, locale constraints should offer user choice or be explicitly justified as region-specific; this file does not provide an opt-in or language selection mechanism.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The description declares the skill as '中国中小企业智能财税技能', which constrains the skill to a China-specific locale in natural language without indicating that the user can choose or opt into that locale. The file does not state that the regional focus is optional or selected by the user.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The manifest describes the free tier as '基础记账', which reasonably implies adding, listing, and summarizing bookkeeping records. This file also exposes a delete action that modifies stored accounting data, a stronger data-management capability not mentioned in the manifest or free-tier description.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstring, CLI description, help text, and runtime messages are all presented only in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module docstring, CLI description, argument names, and all user-facing output are written exclusively in Chinese, which effectively forces a specific language for use of the skill. The file does not offer user opt-in, alternative locale support, or a documented reason that the tool must be Chinese-only.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module usage string and argument help indicate
--地区 <省份>is a meaningful input, and line L165 says the region affects the 城建税 rate. However, the implementation never applies the provided region to select or alter the returned rate data; lines L190-L192 explicitly do nothing. This is an intent/documentation mismatch rather than merely incomplete behavior because the documentation asserts a filtering effect that the code does not perform.- Content