电池消费税合规与政策指引

• Outcome: Review
• Latest audit: Jul 28, 2026 · 5:06 AM UTC
• Version: 3.15.3

Overview

This battery-tax skill mostly provides the advertised tax guidance, but it also has under-disclosed remote service, persistence, configuration-change, logging, and package-install behavior that users should review first.

Install only if you are comfortable with a cloud-backed tax service that may store local credentials/logs and can install or configure related skills when invoked. Avoid entering confidential company identifiers or sensitive tax scenarios unless you understand what is sent remotely, and review/remove any added MCP settings or files under ~/.tax-policy-client and ~/.skills if you later uninstall.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares itself as a narrow tax-compliance assistant, yet static analysis detected capabilities consistent with environment access, file read/write, and network use without corresponding permission disclosure. That combination enables hidden side effects such as local configuration changes, data exfiltration, or remote control paths, and is especially risky because users are not informed that installation or use may touch local files or contact external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a strong description-behavior mismatch: the skill presents as a specialized battery consumption-tax advisor, but analysis indicates it can modify MCP/client configuration, register API keys remotely, perform fallback web searches, install other skill packages, route users to unrelated skills, and write local state. Such hidden multifunction behavior creates a supply-chain and persistence risk, because a user seeking tax guidance would not reasonably expect local config tampering, package installation, or broad outbound network activity.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The code auto-detects host agent types and can modify local MCP/IDE configuration files, behavior unrelated to a battery consumption-tax compliance assistant. Even though it defaults to dry-run in most paths, the module supports non-interactive writes and executes them when run as __main__, creating an unnecessary persistence/configuration-change capability on the user's system.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The module inspects environment variables, home-directory paths, and IDE/client configuration locations to fingerprint the host environment. For a tax assistant, this exceeds functional need and creates unnecessary host reconnaissance that could be repurposed to tailor persistence or evade scrutiny.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring states the module does not handle networking, yet the code selects a remote cloud HTTP transport and embeds a remote service URL. This discrepancy is security-relevant because misleading documentation can conceal remote connectivity and prevent reviewers or users from understanding data-flow and trust boundaries.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The comments claim only a sanctioned endpoint is reused, but the configured endpoint and skill slug identify a different service from the manifested battery tax assistant. This mismatch undermines trust in what service is actually being connected and may redirect users to an unintended remote capability.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The hardcoded SERVICE_URL, SKILL_SLUG, and SKILL_NAME point to a generic tax-policy knowledge service rather than the declared battery consumption-tax assistant. Registering a different remote service than the manifest advertises is dangerous because it can silently swap the skill's effective behavior and expose users to unexpected remote instructions or data handling.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The fallback search scope is broad and covers general tax topics well beyond the declared battery consumption tax purpose. This creates a scope-expansion issue: when remote service is unavailable, the skill may fetch and present unrelated tax guidance from public search engines, increasing the chance of inaccurate advice, unintended data disclosure to third-party search engines, and behavior inconsistent with user expectations for this narrowly scoped skill.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The client auto-registers with a remote service and persistently stores configuration and credentials under the user's home directory, which is broader behavior than needed for a tax advisory helper. Persistent API keys and device identifiers increase the local attack surface and create privacy and credential-management risks, especially on shared systems or environments where file permissions are weak.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The server hard-codes a broad remote tax-policy MCP endpoint that is not clearly limited to the advertised battery consumption-tax specialty. This creates a scope mismatch: users and host agents may trust the skill as narrowly specialized while their prompts and data are actually sent to a more general cloud service with wider capability and data handling implications.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The exposed tools include generic tax Q&A, risk screening, tax calculation, and knowledge-base listing, which materially exceeds the manifest's narrow battery consumption-tax description. In an agent ecosystem, this kind of capability drift can bypass operator expectations, increase accidental data sharing, and enable actions outside the reviewed business purpose.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: The startup path imports and invokes automatic client detection/setup code unrelated to answering tax questions, increasing the skill's side-effect surface. Even though comments suggest writes are gated by an environment variable, the code still performs environment-dependent setup logic at launch and suppresses exceptions, which reduces transparency and can surprise users or host systems.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements a bulk installer/downloader for other skills, including writing into the user's skills directory, which is materially outside the stated purpose of a battery consumption-tax compliance assistant. That mismatch is dangerous because it expands the skill's authority into software installation and code delivery, creating supply-chain and unauthorized capability expansion risk under the guise of a tax helper.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This code resolves local or remote packages and can download and install multiple skills from network locations, which introduces a clear supply-chain risk. Even though it prefers channel-specific URLs and performs basic ZIP checks, it still enables remote code/package delivery unrelated to the core tax-advisory function, increasing the chance of stealthy capability escalation or malicious package substitution.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The script probes local ClawHub configuration paths and CLI presence to infer the installation channel, which is unnecessary for a tax policy assistant and leaks into host-environment discovery. While not directly exfiltrating data, this kind of environment inspection broadens system awareness and can be used to tailor follow-on installation behavior in ways the user did not explicitly request.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The offline fallback content is materially misaligned with the stated skill purpose: it provides general VAT/CIT/PIT references instead of battery consumption-tax guidance. In a tax compliance assistant, this can mislead users into applying irrelevant rules during offline use, causing compliance mistakes, incorrect filings, or missed product-specific exemptions and documentation requirements.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The offline workflow provides generalized tax-compliance guidance covering VAT, CIT, PIT, filing cadence, and broad risk-identification steps, which exceeds the declared battery consumption-tax scope. In a constrained tax advisory skill, this scope expansion can mislead users into relying on out-of-scope guidance, producing incorrect compliance actions or unsafe operational decisions when the authoritative MCP service is unavailable.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The risk engine scans for unrelated financial-crime, restructuring, equity-transfer, cross-border, and family-holding scenarios that are outside the skill's declared battery consumption-tax purpose. This creates dangerous scope drift: users may submit sensitive or unrelated matters and receive simplistic offline risk labels, which can encourage reliance on an unfit tool for legal, tax, or anti-fraud triage and result in serious misclassification.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The page tells users the workflow is '本地保存，不上传' and '本地完成计算', but the JavaScript registers a client, persists identifiers/API keys in localStorage, and posts metrics to a remote cloud API via /auth/register and /topic_selfcheck. This is deceptive data handling: users may provide enterprise tax/compliance information under a false local-only assumption, creating consent, privacy, and trust risks.

Context-Inappropriate Capability

High

• Confidence: 90% confidence
• Finding: The file contains generic helper/export/generation logic for unrelated domains such as R&D hours, project initiation documents, ESOP checklists, and auxiliary ledgers, which is unjustified for a battery consumption-tax assistant. Even if some functions are not visibly wired in this page, shipping unnecessary dormant capabilities increases attack surface, risks accidental future exposure, and suggests poor separation of concerns for a tax-compliance skill handling enterprise data.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The consent text says only indicator values like '研发费用占比、人员比例等' will be sent, which is copied from an unrelated context and does not match this page's battery consumption-tax metrics. Misstating what data categories are transmitted undermines informed consent and can cause users to authorize remote processing based on inaccurate disclosures.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The skill instructs the agent to proactively inject clickable external links whenever the user's intent is only loosely related to the topic. Broad activation increases the chance of unsolicited redirection to external web content, which can be abused for traffic steering, phishing-like UX, or bypassing a user's expectation that the interaction remains in-chat and narrowly scoped.

Vague Triggers

Low

• Confidence: 78% confidence
• Finding: The installation trigger phrase is overly broad and can cause cross-skill installation or topic switching based on natural-language prompts rather than informed consent. In the broader context of detected file/network/config capabilities, this increases risk because innocuous tax questions could lead to unexpected package installation, environment changes, or expanded data sharing beyond the original battery-tax scope.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The function writes to user configuration files after backup without an immediate user-facing confirmation at the write site. Silent or indirect config modification is risky because it can alter tool behavior and establish persistence-like integration without clear consent, especially in a skill unrelated to system configuration.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code automatically modifies VS Code/Cline settings by writing cline.mcpServers entries without an immediate confirmation at the write site. Changing IDE settings can redirect future tool behavior and persist beyond the current session, which is not justified by the tax-assistant purpose.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.