Tax Contract Generation Review 全模板合同生成合规评审与风险防控指引

• Outcome: Review
• Latest audit: Jul 21, 2026 · 12:12 AM UTC
• Version: 3.14.29

Overview

This tax contract skill includes broad skill-installation and remote-service behavior that is partly disclosed but too powerful and under-controlled for a normal contract review tool.

Install only if you are comfortable with the skill potentially changing your installed skill set and sending contract or tax queries to a third-party MCP service. Avoid using it with confidential contracts unless you have reviewed the remote-service and data-handling terms, and prefer a version that separates the installer from contract review and verifies downloaded packages.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill appears to use file read/write and network-capable behavior without declaring corresponding permissions, which creates a transparency and trust gap. In practice, undeclared install/download behavior can lead to unexpected filesystem changes, remote content retrieval, and expansion of the skill’s effective capabilities beyond what a reviewer or user would reasonably expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose materially differs from the described runtime behavior: instead of only providing contract generation/review, it also installs other skill packages, routes requests across multiple skills, and relies on a remote MCP knowledge source. This kind of capability mismatch is dangerous because it can conceal supply-chain risk, unexpected data flow to external services, and broader system modification than users consented to.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script is explicitly designed to install additional skills beyond the declared contract-generation/review functionality. That creates a supply-chain expansion path: invoking this skill can modify the user's environment by adding new code-bearing packages, which is materially broader than the user would expect from a tax/contract review tool.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code probes local configuration files and CLI presence to infer an external distribution channel, which is unrelated to contract review and reveals environmental information. This broadens host introspection and can steer subsequent network/download behavior based on local state without explicit user approval.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script resolves remote URLs and downloads zip packages for installation, enabling remote code/content delivery into the local skills environment. Because there is no visible signature verification, hash pinning, or trust enforcement beyond URL presence, a compromised manifest or endpoint could deliver malicious packages.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The installer writes into the user's skills directory, deletes any existing target directory, and extracts untrusted zip contents to activate other skills. This gives the skill the ability to alter the local agent's executable capability set, making compromise or abuse significantly more impactful than a normal document-review function.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The module documentation states that automatic download and installation of related skills is a core design goal, which materially conflicts with the advertised purpose of contract drafting/review. This scope mismatch is dangerous because users and reviewers may grant trust appropriate for a legal-analysis tool while the code actually performs environment modification and package acquisition.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The invocation guidance encourages broad activation and automatic routing/installation behavior (e.g., one-click installation of a larger skill matrix), which increases the chance of unintentional execution of higher-risk capabilities. In the context of this skill’s undeclared file/network behavior, overly broad invocation becomes more dangerous because benign user requests may trigger downloads, routing, or other side effects unexpectedly.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This client transmits user queries and potentially full contract text to a third-party remote MCP endpoint, but the code provides no consent flow, disclosure, data classification, or minimization controls. In this skill’s context, the payload may contain highly sensitive commercial, legal, personal, or tax information, so silent transmission to an external service materially increases confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code injects the API key into the request body parameters, causing credentials to be handled as ordinary tool input and transmitted to the remote service. This increases the chance of credential exposure through downstream logging, tracing, debugging, persistence, or misuse by the receiving service, especially since there is no indication of safer transport via authorization headers or token-scoped handling.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.