Greek Individual Taxes

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:31 PM UTC
• Version: 0.1.0

Overview

The skill says it only prepares tax data locally, but its instructions also cover email access, bank-data import, tax submission, digital signatures, cloud storage, and payment handling.

Install only if you intend to use a high-trust tax automation skill and can enforce manual approval before email access, bank import, cloud upload, digital signing, AADE submission, or payment scheduling. Do not install it as-is if you only want local tax-return preparation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:8
• Finding: Undisclosed High-Impact Data Access, Tax Submission, and Payment Operations## Vulnerability Details **File Location**: `SKILL.md:8`, `SKILL.md:290`, `SKILL.md:496`, `SKILL.md:511`, `SKILL.md:523`, `SKILL.md:526`, and `SKILL.md:582` **Vulnerability Type**: Authorization-boundary violation and excessive privilege use **Risk Level**: Critical ### Vulnerable Code ```text metadata: {"openclaw": {"requires": {"bins": ["jq"], "env": ["OPENCLAW_DATA_DIR"]}, "notes": "Instruction-only skill. Prepares E1 tax return data from local files. Does not submit to AADE directly — submission is handled by greek-compliance-aade skill with human approval."}} openclaw individual collect-employment-docs --year 2025 openclaw individual process-tax-emails --year 2025 openclaw individual submit-e1-form --digital-signature --confirm-receipt openclaw individual import-bank-data --verify-salary-deposits --track-investments openclaw individual process-tax-payments --schedule-installments --confirm-payments cloud_storage: "Secure document archive with retention policies" ``` ### Technical Analysis The skill metadata defines it as an instruction-only, local-file preparation skill and explicitly states that it does not submit returns directly to AADE. It further claims that submission is delegated to another skill and requires human approval. The subsequent workflow instructions contradict that boundary by directing the agent to: - Collect employment and tax documents. - Process tax-related email. - Import banking and investment data. - Submit an E1 return using a digital signature. - Schedule and confirm tax payments. - Store sensitive documents in unspecified cloud storage. These operations require access to substantially more sensitive resources than local tax-return preparation legitimately needs. The skill does not define mandatory per-operation consent, an enforceable human-approval checkpoint, least-privilege scopes, allowlisted storage destinations, transaction limits, or safeguards for credentials and ...[truncated 2409 chars]
• Remediation: ## Remediation Suggestions 1. Remove email processing, bank import, cloud storage, AADE submission, and payment-processing instructions from this local preparation skill. 2. Delegate every external or consequential operation to separately audited integration skills with narrowly scoped permissions. 3. Enforce a non-bypassable human-approval checkpoint immediately before: - Accessing email or banking data. - Uploading records to external storage. - Applying a digital signature. - Submitting an E1 return. - Scheduling or confirming a payment. 4. Display a complete action preview that identifies the taxpayer, destination, return data, payment amount, payment date, and external service before approval. 5. Use least-privilege, short-lived authorization scopes and prohibit reuse of TAXIS, banking, email, or digital-signature credentials. 6. Require explicit destination allowlists for external services and cloud storage. Document the provider, jurisdiction, retention policy, encryption controls, and deletion procedure. 7. Encrypt sensitive records in transit and at rest, redact secrets and personal data from logs, and maintain an auditable consent record. 8. Separate read-only document import from write, submission, and payment permissions. 9. Add transaction limits, duplicate-submission prevention, rollback or cancellation procedures where supported, and independent submission-receipt verification. 10. Make the metadata accurately describe every required permission and external effect. If the skill remains local-only, enforce that restriction technically rather than relying on descriptive text. 11. Add security tests verifying that external access, digital signing, submission, storage, and payments cannot occur without explicit approval.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill metadata and notes explicitly claim the skill only prepares local E1 return data and does not submit to AADE, but later sections document direct submission, monitoring, and TAXIS preparation actions. This inconsistency is dangerous because downstream agents or users may grant trust and reduced scrutiny based on the earlier safety boundary, while the skill actually describes higher-risk authority over regulated filings.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
export OPENCLAW_DATA_DIR="/data"
which jq || sudo apt install jq
```

No external credentials required. This skill prepares E1 tax return data from local files. Actual submission to AADE is handled by the `greek-compliance-aade` skill with human approval.

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The file states that another skill handles actual AADE submission with human approval, yet later instructs this skill to submit E1 forms directly. In a tax context, this breaks separation of duties and can enable unauthorized or premature filing of sensitive, legally binding returns under the false assumption that human review occurs elsewhere.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: Bank-data import and tax-payment processing go materially beyond preparing an individual tax return and introduce financial-action capabilities. In the context of tax workflows, these functions expose bank data and create a path to unauthorized payment scheduling or execution, especially if users rely on the earlier claim that the skill is local-only and non-submitting.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: This JSON file is a manifest-like artifact, so SQP-1 applies. The prompt text is phrased as broad natural-language requests such as 'Prepare E1 tax return...' without any stated trigger constraints, explicit invocation syntax, or exclusion conditions, which could overlap with ordinary user requests and cause unintended activation in a system that maps prompts directly to skills.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The line describes a generic request to 'Process individual tax return...' and does not specify whether it is only an example input, a test case, or an activation phrase. In manifest-style files, lack of specificity about trigger scope can make ordinary tax-assistance requests unintentionally match.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The request 'Calculate ENFIA property tax...' is natural everyday task language and lacks any contextual limiter such as environment, command prefix, or non-trigger examples. If consumed by orchestration logic, this ambiguity could broaden activation beyond intended contexts.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The prompt is a broad natural-language request for tax optimization and does not indicate when the skill should activate or when it should not. Under SQP-1 for manifest-like files, this is a vague trigger pattern because no negative examples or narrow context are provided.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The phrase 'Prepare comprehensive E1 tax return package...' is generic enough to resemble common user requests, yet the file provides no trigger boundaries or explicit statement that it is only a test prompt. This can create accidental matches in systems using manifest/config content to guide invocation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
export OPENCLAW_DATA_DIR="/data"
which jq || sudo apt install jq
```

No external credentials required. This skill prepares E1 tax return data from local files. Actual submission to AADE is handled by the `greek-compliance-aade` skill with human approval.

• Confidence: 89% confidence
• Finding: The setup instructions recommend `sudo apt install jq`, introducing privileged system modification for a skill that is described as instruction-only. Even though `jq` itself is common, encouraging root execution in skill setup expands attack surface and normalizes privilege escalation where it should not be necessary.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Autonomous email processing and client auto-response extend the skill from local tax preparation into communication handling over sensitive tax documents and notices. That increases the chance of unintended disclosure, processing of spoofed messages, or sending inaccurate tax-related communications without explicit user review.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: Forcing `--auto-respond-greek` without clear user opt-in can cause the system to send external communications automatically in a regulated tax context. This is risky because it can misrepresent the user, disclose sensitive case details, or generate legally meaningful communications without review.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The expectation explicitly requires 'professional client communication materials in Greek,' which imposes a language requirement in natural language. Under SQP-3, forcing a specific language without user opt-in can violate language/locale policy unless the regional constraint is clearly documented and justified.

Static analysis

No suspicious patterns detected.