销售税查询(免费版)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.1

Overview

The skill is a disclosed ZipTax lookup helper, but it asks for broad agent permissions and gives unsafe API-key handling guidance.

Review before installing. Use this only for explicit ZipTax sales-tax lookups, avoid pasting sensitive customer addresses unless third-party transmission is acceptable, and do not store the API key in shell startup files or expose it in logs/process listings. The publisher should narrow activation text, remove unrelated CRUD claims, and document safer secret handling.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:125

Finding

API Key Persisted in a Plaintext Shell Startup File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 125
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: Medium

bash

# Permanently save the key by adding it to ~/.bashrc or ~/.zshrc
echo 'export ZIPTAX_API_KEY="your-api-key-here"' >> ~/.bashrc

Technical Analysis

The Skill recommends persisting the ZipTax API key directly in a shell startup file. When the placeholder is replaced with a real key, the credential is stored as plaintext and automatically loaded into every shell session.

Shell profile files are not dedicated secret stores. They may be exposed through backups, support bundles, accidental repository commits, home-directory sharing, overly permissive file permissions, or unrelated processes operating under the same account. This conflicts with the document's separate recommendation to use secure secret management and exceeds the minimum secret-storage privileges needed to perform tax lookups.

Attack Path

1. The user follows the documented command and replaces the placeholder with a valid API key.
2. The key is written in plaintext to ~/.bashrc.
3. An attacker or unrelated local process obtains read access to the file through compromised account access, permissive permissions, backups, or diagnostic collection.
4. The attacker extracts the value assigned to ZIPTAX_API_KEY.
5. The attacker replays the credential against the ZipTax API.

Impact Assessment

Successful exploitation exposes the user's ZipTax credential. An attacker could submit API requests under the victim's account, consume the free or paid request quota, access account metrics available to that key, and cause service disruption or unexpected charges depending on the account plan.

This does not grant operating-system privilege escalation by itself. Its scope is limited to the permissions and account capabilities associated with the exposed API key.

Remediation

View remediation

Remediation Suggestions

• Remove the recommendation to store the key directly in ~/.bashrc or ~/.zshrc.
• Prefer an operating-system credential store, such as macOS Keychain, Windows Credential Manager, or a Linux secret service.
• For production use, recommend a dedicated secrets manager such as AWS Secrets Manager, HashiCorp Vault, or an equivalent platform service.
• If a configuration file must be supported, store it outside the repository and enforce owner-only permissions, such as mode 0600.
• Add instructions for credential rotation and immediate revocation following suspected disclosure.
• Warn users not to include shell profiles or environment dumps in repositories, logs, support bundles, or debugging output.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:189

Finding

API Key Exposed Through Curl Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 189–191
Vulnerability Type: Process-visible credential exposure
Risk Level: Medium

bash

if [ -n "${METRICS:-}" ]; then
  curl -s "$API_URL/account/metrics" -H "X-API-KEY: $ZIPTAX_API_KEY"
else
  curl -s "$API_URL?$QUERY" -H "X-API-KEY: $ZIPTAX_API_KEY"
fi

Technical Analysis

The shell expands ZIPTAX_API_KEY before starting curl, placing the complete authentication header in the process argument vector. Depending on operating-system controls and monitoring configuration, command-line arguments can be observed through process inspection, audit systems, endpoint monitoring, crash diagnostics, or debugging tools.

Sending the key to the declared HTTPS API is necessary for the Skill's functionality. The issue is not the authorized network transmission itself, but exposing the credential through a command-line parameter when safer input mechanisms are available.

The lookup query also necessarily transmits a postal code, coordinates, or street address to api.zip-tax.com. The audited material discloses this external service dependency, and no evidence was found that unrelated files, environment variables, credentials, or Agent data are transmitted.

Attack Path

1. The user invokes the documented CLI with a valid ZIPTAX_API_KEY.
2. The shell expands the variable into the curl header argument.
3. While the request is running, a local process, monitoring agent, or user with sufficient process-inspection access captures the command-line arguments.
4. The observer extracts the value following X-API-KEY:.
5. The captured key is replayed against the ZipTax API until it is revoked or expires.

Impact Assessment

A successful attacker obtains the same ZipTax API permissions as the victim's key. This may permit unauthorized tax-rate queries, account-metrics access, quota exhaustion, and possible billing impact.

Exploitation requir ...[truncated 235 chars]

Remediation

View remediation

Remediation Suggestions

• Avoid expanding authentication secrets directly into process command-line arguments.
• Supply the header through a protected temporary configuration mechanism, standard input, or another facility that does not expose the key in the argument vector.
• If a temporary curl configuration file is unavoidable, create it with owner-only permissions, avoid shared temporary directories, and delete it immediately after use.
• Ensure verbose shell tracing is disabled around secret handling; never enable set -x while processing the key.
• Document that process-monitoring and diagnostic systems must redact authentication headers and environment variables.
• Apply API-side controls where supported, including key rotation, usage alerts, request limits, and narrowly scoped credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

��开始

第一步:获取 API Key

1. 访问 zip-tax.com 平台
2. 注册账号并登录
3. 进入 DEVELOP > API Keys 页面
4. 创建 API Key 并保存

第二步:配置环境变量

bash

# Linux / macOS
export ZIPTAX_API_KEY="your-api-key-here"
# ...
# Windows PowerShell
$env:ZIPTAX_API_KEY="your-api-key-here"
# ...
# 永久保存(添加到 ~/.bashrc 或 ~/.zshrc)
echo 'export ZIPTAX_API_KEY="your-api-key-here"' >> ~/.bashrc

第三步:执行查询

bash

# 使用 curl 直接查询
zip-tax.com/request/v60?postalcode=92618" \
  -H "X-API-KEY: $ZIPTAX_API_KEY"
# ...
# 或使用 CLI 封装
bash （请参考skill目录中的脚本文件） --postalcode 92618

示例

CLI 封装脚本(lookup.sh)

bash

#!/usr/bin/env bash
# （请参考skill目录中的脚本文件） — 销售税查询 CLI 封装
set -euo pipefail
# ...
if [ -z "$ZIPTAX_API_KEY" ]; then
  echo "错误:未设置 ZIPTAX_API_KEY 环境变量"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill name, summary, description, usage guidance, and examples are all presented in Chinese, and there is no indication that users may choose another language or that the locale is intentionally restricted. This can violate language/locale policy when a skill effectively imposes a specific language without opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises activation for broad coding-assistance and development-work phrases unrelated to tax lookup. In agent ecosystems, over-broad trigger phrases can cause the skill to be invoked in contexts where users did not intend external API use, increasing the chance of unnecessary data transmission or misuse of exec-enabled functionality.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest and surrounding documentation present this skill as a sales-tax lookup tool, but lines L058-L078 describe broad CRUD-style capabilities such as create, modify, delete, reset, import, save, and convert. The rest of the file only documents read/query-style API calls and a simple lookup CLI, so this section overstates the skill's behavior and creates a semantic mismatch about what the skill actually does.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The scope statement enumerates very broad keywords, including generic development and assistance terms, that could match unrelated user requests. This widens the chance of unintended skill activation and external calls to the third-party service, which is risky given the skill has exec capability and uses an API key.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The skill sends user-supplied address data and an API key to an external service at api.zip-tax.com. External transmission is expected for this skill's purpose, but it still creates privacy and credential-handling risk because potentially sensitive location data leaves the agent environment.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

场景 1:按地址查询销售税(推荐)

bash

curl -s "https://api.zip-tax.com/request/v60?address=200+Spectrum+Center+Drive+Irvine+CA+92618" \
  -H "X-API-KEY: $ZIPTAX_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The CLI example performs external HTTP requests to api.zip-tax.com using an API key header. This is functionally necessary, but combined with exec support it increases the chance that users unknowingly transmit data or use the skill in environments where outbound network access should be restricted.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md

exit 1
fi
# ...
API_URL="https://api.zip-tax.com/request/v60"
# ...
# 解析参数
while [[ $# -gt 0 ]]; do

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The JavaScript example transmits postal code data and an API key to an external service. Although this is inherent to the feature, it is still a real data egress path and should be treated as such in an agent skill, especially if users may paste confidential addresses into generated code or tests.

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

javascript

// 解析 v60 响应
const response = await fetch(
  `https://api.zip-tax.com/request/v60?postalcode=92618`,
  { headers: { 'X-API-KEY': apiKey } }
);
const data = await response.json();

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The top-level description limits the skill to address/postal code/coordinate tax lookup, tax-rate parsing, and basic CLI wrapping. Later sections and the CLI example add an extra capability to query account usage metrics via /account/metrics, which is not reflected in the manifest description.

Content

No source excerpt is available for this finding.