税务BP客服知识库

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:43 AM UTC
• Version: 2.4.0

Overview

The skill has a coherent tax-support purpose, but it asks the agent to run user-derived search text through a shell-style command and relies on mutable knowledge documents without prompt-injection boundaries.

Install only if you trust the Citadel document editors and the runtime executes search commands safely as structured arguments rather than through a shell. Before broad use, add explicit safeguards that fetched document content is reference data only, validate search keywords and result domains, and keep tax answers tied to confirmed policy sources.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:151

Finding

Shell Command Injection Through User-Derived Search Keywords

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 151-155
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable code snippet:

text

When the internal knowledge base does not contain a match and the question concerns tax policy or regulations:

1. Extract keywords from the question, prioritizing document number, tax type and subject, then broad terms.
2. Execute the search command: `catclaw-search "National Tax Administration {keyword}" --no-fast`
3. Retrieve the original policy: `web_fetch <result URL>`

The snippet above is an English rendering of the instructions at the cited location; the executable command structure is preserved.

Technical Analysis

The Skill directs the Agent to derive {keyword} from an untrusted user question and interpolate it into a command enclosed with double quotes. It does not require structured argument passing, shell escaping, metacharacter rejection, or an allowlist.

If the runtime executes this command through a shell, double quotes do not neutralize command substitution, and an attacker may also close the quoted argument and introduce command separators. For example, a keyword shaped like "; id; # would produce a command structurally equivalent to:

bash

catclaw-search "National Tax Administration "; id; #" --no-fast

The shell would interpret id as a separate local command rather than as part of the search query. Similar input could invoke other binaries available to the Agent process.

Attack Path

1. An attacker submits a tax-policy question containing shell syntax in the portion likely to be extracted as a search keyword.
2. The internal knowledge documents do not match the question, causing the fallback search workflow to run.
3. The Agent inserts the attacker-controlled keyword into the documented command template.
4. A shell-mediated tool runner parses the injected quote and command separator.
5. T ...[truncated 751 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace command-string construction with a structured tool API that passes each argument separately:

   text

   executable: catclaw-search
   arguments:
     - National Tax Administration <validated keyword>
     - --no-fast
   

2. Do not invoke the command through sh -c, bash -c, or an equivalent shell interpreter.
3. Apply a strict length limit and character allowlist appropriate for tax search terms. Reject control characters, quotes, backticks, dollar signs, newlines, command separators, redirection operators, and shell expansion syntax.
4. Keep the search process in a sandbox with minimal filesystem, credential, and network access.
5. Add security tests covering quote termination, command substitution, newlines, separators, pipes, redirection, and Unicode control characters.
6. Validate result URLs independently before passing them to web_fetch, permitting only HTTPS and approved government domains where policy requires authoritative sources.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:8

Finding

Indirect Prompt Injection Through Mutable Knowledge Documents

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-10, 29, 103-110, 116-120, and 166-170
Vulnerability Type: Untrusted remote-content instruction injection
Risk Level: Medium

Relevant code snippets:

text

Core design: All knowledge content, including indexes and full text, is stored in Citadel documents. The Skill itself contains no knowledge entries. Changes made by BP editors take effect immediately without updating the Skill.

bash

oa-skills citadel getSimpleMarkdown --contentId 2769388613
oa-skills citadel getSimpleMarkdown --contentId 2769787851
oa-skills citadel getSimpleMarkdown --contentId 2769947356
oa-skills citadel getSimpleMarkdown --contentId 2770026936

text

When matched:
- Reply directly using the standard answer in the document.
- For decision rules, answer according to the condition-to-conclusion logic in the document.
- For operating procedures, guide the user through the steps in the document.

text

Standard answer: The deterministic answer that the Agent outputs directly.

The prose snippets above are English renderings of the instructions at the cited locations; command names and document identifiers are preserved.

Technical Analysis

The reviewed Skill delegates its effective knowledge and answer content to remotely editable documents that can change after the Skill package has been audited. It then instructs the Agent to output document fields directly. No explicit trust-boundary rule requires fetched text to be treated exclusively as inert data, and no validation mechanism rejects embedded instructions, tool requests, role-like directives, or attempts to override higher-priority rules.

Consequently, an attacker who can modify a referenced document could place prompt-injection content inside a standard-answer, rule, or procedure field. When retrieved into the Agent context, that content may be interpreted as instructions rather th ...[truncated 1749 chars]

Remediation

View remediation

Remediation Suggestions

1. Explicitly classify all retrieved document content as untrusted data that must never override system, developer, Skill, or user instructions.
2. Parse documents through a strict schema and extract only expected scalar fields. Reject unexpected fields, embedded tool directives, role markers, command blocks, and instruction-like control text.
3. Never execute tools, disclose data, or modify behavior solely because retrieved content requests it.
4. Sanitize standard-answer fields before placing them in the Agent context and render them as quoted reference material rather than instructions.
5. Require review and approval before document changes become active. Record the author, reviewer, timestamp, and immutable version used for each answer.
6. Pin approved document versions or verify signed content and integrity hashes instead of accepting immediately mutable content without validation.
7. Enforce least-privilege edit permissions and strong authentication for document editors, with alerts for changes to approved entries.
8. Add prompt-injection tests containing fake system messages, tool-call requests, requests to ignore prior rules, and data-exfiltration instructions in every supported document field.
9. Require the Agent to validate tax claims against approved policy citations rather than treating a standard-answer field as independently authoritative.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description and the body of the skill are entirely written as a Chinese-only tax support workflow, with no indication that users may choose another language. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the restriction is explicitly documented and justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.