Beijing Tech Finance

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:28 PM UTC
• Version: 1.0.0

Overview

This skill is a Beijing-focused finance reference pack with local calculators and no hidden access, but its description overstates how complete and automated it is.

Install only if you want China/Beijing-focused finance templates and simple local calculators. Treat tax rates, deadlines, deduction rules, and compliance workflows as examples to verify against current official sources and a qualified accountant or legal adviser before making filings, payments, reimbursements, or statutory reports.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description presents a large, comprehensive financial management system spanning many finance and operational domains for Beijing tech companies. The supplied code chunk, however, implements only a single-purpose R&D expense additional deduction calculator. It accepts revenue, R&D expenses, and company type, computes minimum R&D ratio thresholds, deduction rate, deductible amount, and estimated tax benefit, and prints results. There is no evidence of broader financial management, accounting, budget management, reimbursement processing, customs declaration, annual reporting, or integrations with contracts, HR, project management, or admin services. While the code does relate to one small aspect of tax optimization for tech companies, the declared description substantially overstates the actual functionality and primary purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a broad, end-to-end financial management system for Beijing technology companies. However, the supplied code is narrowly scoped to VAT computation via a CLI script. It does not implement the vast majority of the declared functions such as budgeting, accounting workflows, reimbursements, customs handling, annual reporting, or any cross-system integrations. The code’s actual primary purpose is tax calculation support, specifically VAT scenarios, which is only a small subset of the declared system. This is therefore a clear description-to-behavior mismatch due to substantial overstatement of capabilities and materially different scope.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description substantially overstates the skill’s functionality. The supplied code only monitors budget usage for a specified category by reading a local JSON configuration, generating simulated expense figures, calculating usage rates, and emitting warnings. It does not implement accounting systems, tax optimization, expense reimbursement, customs declaration, annual reporting, or any cross-functional integrations mentioned in the description. This is a material description-to-behavior mismatch because the primary purpose in code is narrow budget monitoring rather than a comprehensive financial management system.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill invites activation for essentially any financial-management task, including tax compliance, reporting, reimbursements, and cross-functional coordination, despite providing broad generic guidance rather than tightly bounded workflows. In a sensitive finance context, such overbroad routing can cause the agent to be used for high-stakes decisions beyond validated competence, increasing the risk of incorrect compliance, financial, or operational outputs.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file presents all workflow instructions and templates exclusively in Chinese, and there is no natural-language indication that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the stated policy, forcing a specific language without user opt-in is a language/locale policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file's natural-language descriptions and all user-facing CLI messages are written only in Chinese, indicating a fixed language choice. The file does not offer a user opt-in for language/locale selection or explain that it is intentionally limited to a China-specific audience, which matches the policy's language/locale concern.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The module docstring, CLI usage, and error/help text are presented exclusively in Chinese, which effectively forces a specific language for users. The file does not indicate that the skill is region-specific or provide any opt-in or alternative language support, which matches the language/locale policy violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The command-line interface prints usage guidance and validation/error messages in Chinese, requiring users to interact in that language. Because no language selection or explicit justification is provided, this is a natural-language locale policy concern rather than a code-security issue.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The module docstring says the script supports '实时监控和预警' for budgets, which implies live monitoring based on actual financial data. In practice, the script runs once from command-line input, reads a local config file, and explicitly uses mocked random expense values rather than real monitored data.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file’s natural-language interface is entirely in Chinese, including the module description, usage text, errors, and output messages. For a general-purpose script, this imposes a specific language/locale on users without opt-in or an explicit justification that the tool is region-specific only.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The docstring for calculate_budget_usage says it returns budget usage details, suggesting computed actual figures. However, the annual figure is not actual accumulated spending: the code labels it as a simplified estimate and computes it by multiplying the current month's simulated expense by the month number.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The manifest description states the skill is for "Beijing-based" technology companies, which embeds a locale-specific constraint in natural language. There is no indication here that users can opt into this locale scope or that the regional limitation is explicitly justified as a compliance or region-specific requirement.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The entire skill content is presented only in Chinese and is explicitly framed as a Beijing-specific financial policy document, but it does not indicate that language or locale selection is optional or user-chosen. Under the policy, forcing a specific language/locale without opt-in can be a natural-language policy violation unless the regional constraint is clearly documented and justified.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The skill content is presented entirely in Chinese and does not indicate that users may choose another language or locale. Under the language/locale policy rule, forcing a specific language without user opt-in can be a natural-language policy concern unless the restriction is clearly documented and justified.

Intent-Code Divergence

Low

• Confidence: 91% confidence
• Finding: The module-level documentation states the script is a calculator supporting 100% super-deduction for high-tech enterprises, which suggests a narrower purpose. In implementation, the function handles multiple company types and different deduction rates, so the documentation does not accurately reflect the broader behavior.

Static analysis

No suspicious patterns detected.