Property Tax Appeal

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:11 AM UTC
• Version: 3.1.0

Overview

This skill is a disclosed property-tax appeal packet workflow with proportionate local validation, public-source research, and file generation guardrails.

Install only if you are comfortable letting the agent research public property records and create local appeal packet files. Keep owner documents in a case-specific folder, do not paste private portal links or credential-bearing URLs into case data, and independently verify deadlines, forms, and filing requirements with official sources before filing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description promises an end-to-end appeal triage and valuation-support workflow for US residential assessment challenges, with substantial property-specific analysis and document generation. The actual code only performs state/DC jurisdiction profile lookup from a local JSON file and prints routing/reference information. While this is loosely related to one narrow slice of the declared purpose—identifying jurisdiction-specific rules and starting points—it is far too limited to accurately represent the described skill. The code’s primary purpose is materially narrower and different from the declared functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about real-property assessment appeal triage, market-value analysis, comparable sales, requested value estimation, and producing evidence packets. The supplied code does none of that. Instead, it is a general-purpose URL validation and network-safety module focused on canonical HTTPS URLs, hostname/IP parsing, special-use domain blocking, and optional DNS resolution checks. This is a materially different primary purpose and represents undeclared capabilities unrelated to the described tax-assessment workflow. Therefore this is a clear mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

- `scripts/build_appeal_packet.py` for structural validation and private, no-clobber, failure-atomic Markdown/PDF generation.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

- `scripts/build_appeal_packet.py` for structural validation and private, no-clobber, failure-atomic Markdown/PDF generation.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

- `scripts/build_appeal_packet.py` for structural validation and private, no-clobber, failure-atomic Markdown/PDF generation.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

## Workflow

1. Accept the address and notice value without requiring the owner to complete a questionnaire first.
2. Classify the appeal ground before valuing the property. Continue only when market value is material, and set `case.appeal_ground` to `market_value`. If the requested ground is unequal/non-uniform appraisal, exemption, classification, ownership, special valuation, or another non-market issue, stop packet generation. Return only the verified authority, form, deadline, and a clear statement that a jurisdiction-specific evidence model is required. Do not convert neighboring assessments into sale evidence.
3. Inspect the notice or official record and identify exactly what the supplied number means: market, fair-market, just, appraised, true, assessed, equalized-assessed, or taxable value. Do not infer that a locally named `appraised value` is market-comparable. Require a sourced `sale_comparable_market_value` basis before comparing the value with sales.
4. Normalize the state and run `python3 scripts/lookup_jurisdiction.py --state <code>`. Treat the result only as a research starting point. Verify the parcel, local authority, assessment event, value terminology, assessment ratio or cap, valuation date, filing stage, form, deadline, submission page, and accepted evidence window from current official sources.
5. Preserve formal rights while an informal review is pending. State clearly when the informal step does not toll or extend a formal deadline.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly directs use of local file reads/writes, network retrieval, and shell execution via Python scripts, but it does not declare any tool scope or permission boundaries. In an agent environment, this increases the chance the skill will be granted broader capabilities than intended, making misuse or accidental access to local data and external resources more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states it will 'Default to an English supporting attachment,' which imposes a language choice by default rather than offering the user a language or locale option. This is a natural-language policy concern because the file does not indicate user opt-in or a justified locale-specific constraint for English output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

These lines instruct the user to 'use an official English spelling' when unsupported characters prevent PDF generation. That language constrains output to English rather than presenting a user choice or a clearly justified locale limitation.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This JSON manifest-style file defines a broad 'case-template' for a property assessment review but does not include any explicit activation conditions, trigger phrases, exclusions, or contextual limits. For manifest files, the absence of trigger specificity can cause a skill to be invoked in unintended contexts if downstream tooling infers activation from general purpose descriptions alone.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The phrase "Deliverables: concise English Markdown and matching visually checked PDF" imposes a specific language in the methodology's natural-language guidance. The file does not offer user opt-in or explain a region-specific reason that would justify requiring English-only output.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.