T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/C8-workflow.md:300- Finding
Autonomous Tax Submission Workflows Lack an Explicit Final Approval Gate
- Content
View full analysis
- Remediation
View remediation
Security audit
Bookkeeping Agency Skill System
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent bookkeeping-agency documentation, but it describes some tax filings as fully automatic without an explicit final approval gate.
Install only if you intend to use it for Chinese bookkeeping-agency workflows. Before connecting it to real tax bureau, bank, HR, or customer systems, require draft-only defaults, exact-payload human approval for every government filing, least-privilege connectors, authorization checks, redaction, retention limits, and audit logging.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (18)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list is unusually broad and includes generic finance/accounting terms such as bookkeeping, tax filing, accounting agency, 财税, and 工商注册 that can match many ordinary conversations outside the intended scope. This can cause unintended activation in sensitive business or tax contexts, leading the agent to inject specialized workflow instructions, read additional reference files, or handle regulated financial content when the user did not explicitly request this skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description and primary document heading present the skill in Chinese only, with no statement that users may choose their preferred language. This can amount to a language policy issue when the skill experience implicitly forces one language without opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This section describes fully automated collection and NLP analysis of social-media/public-opinion data across multiple platforms, including negative-publicity monitoring and alerting, but provides no privacy notice, data-minimization boundary, or handling guidance for personal data that may be captured. In this business context, the workflow is more dangerous because it is intended for continuous monitoring of named brands and complaints, which can easily ingest personal identifiers, sensitive allegations, and platform-specific content in ways that create privacy, compliance, and misuse risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The negative-publicity response SOP explicitly references customer and employee information, plus scenarios such as privacy leakage, but does not warn users about sensitive-data handling, disclosure limits, or incident-response safeguards. That omission is risky because the workflow could prompt operators to paste, summarize, or circulate PII and internal case details during crisis handling, increasing the chance of secondary privacy exposure or improper internal sharing.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown skill defines all headings, inputs, outputs, and operating descriptions exclusively in Chinese. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and the document provides no alternative language option or justification for the restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file consistently specifies the skill in Chinese and does not state that the skill is China-region specific or that users may choose another language. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
C3-22 describes automatic generation of multi-channel marketing materials using inputs from earlier customer acquisition units, including customer profiles,优惠/话术/活动信息, and channel-adapted content, with no explicit privacy notice, data-minimization constraint, or prohibition on using personal or sensitive customer data in prompts or outputs. In this business context, the skill is designed to operationalize targeted outreach at scale, so absent safeguards it can lead to unauthorized use of customer data, profiling, or publication of personalized content without adequate review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This section explicitly describes fully automated ingestion and processing of highly sensitive business, financial, tax, HR, and customer data from multiple systems and formats, with '无需人工干预' and no accompanying privacy, consent, minimization, retention, access-control, or human-review safeguards. In the context of a bookkeeping/tax agency skill, these data categories are especially sensitive and regulated, so normalizing unrestricted automation increases the risk of over-collection, unauthorized analysis, and downstream disclosure or misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The markdown states that reports are automatically aggregated and generated from all prior analytics outputs and may be published after only optional human review. Because upstream units include sensitive financial, tax-risk, customer, complaint, HR, and compliance data, automated report generation without mandatory review, redaction, audience scoping, and disclosure controls can expose confidential information or inaccurate risk conclusions to unintended recipients.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown skill description consistently uses Chinese for all titles, inputs, outputs, and operational guidance. Under the natural-language policy rules, forcing a specific language without user opt-in or an explicitly justified regional scope is a policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This skill explicitly processes highly sensitive personal and business data, including contact details, ID documents, bank account information, tax identifiers, complaint records, and behavioral profiles, while providing no visible privacy notice, consent requirements, data minimization guidance, or handling restrictions. In the bookkeeping and tax-service context, this increases the risk of unauthorized collection, over-processing, regulatory noncompliance, and downstream misuse of customer data across many workflow stages.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill specifies fully automated compliance self-checking, scoring, and risk classification without warning that automated judgments may be incomplete, outdated, or require qualified human review. In a regulated accounting and tax domain, incorrect automated compliance conclusions can directly affect licensing, regulatory readiness, staffing decisions, and remediation priorities, creating meaningful legal and operational risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document title and descriptive content are written entirely in Chinese, and the file provides no indication that language selection is optional or that the skill is intentionally limited to Chinese-speaking users. Under the policy, a skill that effectively mandates a specific language without opt-in can be a natural-language locale violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file presents all skill names and instructions in Chinese, and there is no statement that the skill is China-specific or that users may choose another language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The document presents the skill entirely in Chinese and does not indicate that the language is optional, configurable, or required for a justified region-specific purpose. Under the language/locale policy, forcing a single language without user opt-in can be a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
All natural-language instructions and labels in the file are in Chinese, and there is no indication that users may choose another language or that the language restriction is an explicit, justified policy. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This section describes fully automated remindering over a centralized credential ledger that includes license numbers, validity periods, and personnel qualification records, but provides no warning or safeguards for handling sensitive personal and compliance data. In a bookkeeping and tax-services context, these datasets can include identity-linked professional credentials and regulatory status, so unguarded automation increases the risk of over-collection, unauthorized disclosure, and inappropriate downstream use.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains only Chinese-language content and does not indicate that the skill is region-specific or that users can opt into this locale. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.