ClawHub
Back to skill

Security audit

跨境多国税务速查

Security checks for vulnerabilities and agentic risk

Overview

This is a tax-reference skill with no executable code, network behavior, persistence, or credential handling, but users should treat its tax guidance as informational only.

Install only if you want an informational cross-border tax checklist. Verify current rates, registration thresholds, and filing duties with official tax authorities or a qualified tax professional before registering, filing, or changing tax strategy, especially for EU OSS, marketplace-facilitator, and double-taxation questions.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The skill contains inconsistent and legally sensitive tax guidance in its examples, including a categorical conclusion about EU remote-sales/VAT obligations that may conflict with earlier framing and can mislead users into incorrect compliance actions. In a tax-compliance skill, contradictory regulatory statements are dangerous because users may rely on them for registration or filing decisions, creating financial penalties and compliance exposure.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrases are overly broad and match common, everyday tax questions, which can cause the skill to activate outside its intended cross-border scope. That increases the chance users receive jurisdiction-specific compliance output for incomplete or unrelated situations, leading to mistaken reliance on generic tax guidance.

Vague Triggers

Medium
Confidence
90% confidence
Finding
Broad advisory triggers like tax optimization or avoiding double taxation can pull the skill into high-risk legal/tax-advice scenarios beyond a simple reference tool. In this context, the skill may offer incomplete compliance guidance that users could interpret as professional advice, increasing risk of noncompliance or improper tax structuring.

Static analysis

No suspicious patterns detected.