Security audit

Agent Code No.7 Tax Butler

Security checks for vulnerabilities and agentic risk

Overview

This is a static Chinese tax-planning guidance skill with no executable code, persistence, or hidden tool use, though users should avoid sharing unnecessary confidential financial details.

Install only if you need China-focused tax planning or compliance drafting. Treat outputs as informational, verify current policy citations and effective dates, and avoid entering unnecessary company identifiers, personal taxpayer data, or confidential financial details.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly asks for company name, location, revenue scale, tax burden, and planning needs, which are sensitive business and financial data, but it provides no warning about minimizing sensitive inputs, redacting identifiers, or handling confidential information securely. In a tax-planning context, users are likely to paste real corporate data, so the omission increases the risk of unnecessary disclosure, privacy issues, and leakage of commercially sensitive information.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: The skill description and system prompt are entirely framed for Chinese tax-law expertise, implying a fixed language/locale experience. Under the policy, locale-specific behavior should either offer user opt-in/choice or clearly document why the locale restriction is required.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The package description is written entirely in Chinese ("税务管家 - 税务筹划与合规审查") with no indication that the skill supports other languages or that this locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.