数据资源入表税务合规与风险防控指引

• Outcome: Review
• Latest audit: Jul 28, 2026 · 5:06 AM UTC
• Version: 3.15.3

Overview

The skill mostly matches a tax-compliance assistant, but it also installs other skills, configures remote MCP access, and stores/transmits identifiers and API keys in ways users should review first.

Install only if you are comfortable with a cloud-backed tax assistant that may register a client identity, store API keys locally, send tax/compliance prompts or self-check metrics to remote services, and optionally install a broader tax skill matrix. Avoid entering sensitive business, personal, or regulated financial details unless the publisher provides clearer retention, credential-storage, and package-integrity guarantees.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (65)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill is presented as a narrowly scoped tax-compliance guide, yet static analysis detected capabilities associated with environment access, local file read/write, and network use without declared permissions. That mismatch prevents informed consent and creates a path for covert configuration changes, local data access, and outbound data transfer far beyond what a user would expect from a documentation-like skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a major description-behavior mismatch: the skill claims to be a specialized data-asset tax assistant, but analysis indicates it can modify MCP client configs, register API keys, persist local state/logs, proxy requests to a fixed remote service, perform fallback web searches, and install additional skills. In a security context, that combination is dangerous because it broadens trust from a topical advisory skill to a general-purpose local/remote integration agent with supply-chain, privacy, and persistence risks.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The privacy statement says no device or personal data is collected, while the same document instructs users to open external web pages and references server-side service calls and shared knowledge bases. Misleading privacy claims are dangerous because users may disclose sensitive financial, tax, or listing-preparation data under false assumptions about collection and retention.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: A topical tax advisory skill should not implicitly act as a cross-skill installer/distributor unless that capability is prominently disclosed and strictly controlled. Embedding matrix-wide installation and routing expands the attack surface to additional packages and remote content, increasing supply-chain and unauthorized capability escalation risk.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Automatic downloading of additional tax skill packages is not necessary for answering data-asset tax questions and introduces classic supply-chain risk. If exploited or misconfigured, this can pull in unreviewed capabilities, modify the local environment, and extend access without the user's informed approval.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This module performs generic agent fingerprinting and MCP bootstrap/configuration, which is unrelated to the declared tax/data-asset assistant purpose. In a skill that users expect to provide tax compliance help, hidden environment inspection and client integration logic materially expands trust boundaries and can be used to silently route users to an external service or prepare persistence-like integration without clear necessity.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code writes or merges entries into local Claude/Cursor/VS Code/Cline configuration files, effectively altering client behavior and establishing persistent MCP connectivity. For a tax assistant, this capability is unjustified by the stated purpose and creates a meaningful risk of unauthorized persistence, service registration, and redirection of future agent interactions to an external endpoint.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The documentation minimizes network responsibility, yet the code explicitly chooses a remote HTTP MCP endpoint and prepares configuration to use it. That mismatch is dangerous because it can mislead reviewers and users about external connectivity, data flow, and operational behavior, reducing the chance that remote service risks are properly assessed.

Description-Behavior Mismatch

Medium

• Confidence: 80% confidence
• Finding: The code defines generic external search engines and later uses them as a fallback path, which extends data handling beyond the skill’s declared tax-data-asset assistant scope. In this context, user tax/compliance prompts may be sent to third-party search providers, creating unnecessary data exposure and capability expansion without clear necessity or consent.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The client automatically registers with a remote service, obtains an API key, and persists credentials locally under the user’s home directory. This creates an undisclosed outbound trust relationship and stores reusable credentials on disk, increasing the risk of unauthorized use or leakage if the workstation or profile is compromised.

Context-Inappropriate Capability

Low

• Confidence: 77% confidence
• Finding: The module performs import-time agent detection/setup behavior unrelated to the core tax assistant function. Even though it is framed as dry-run detection, executing environment-probing logic on import expands the attack surface and introduces side effects before the caller explicitly requests functionality.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The module documentation presents the server as a simple proxy exposing a fixed cloud tool surface, but initialization also imports and runs agent detection/setup logic with potential side effects. Hidden setup behavior is security-relevant because it can alter the host environment or agent configuration unexpectedly, especially since activation is attempted automatically and exceptions are silently suppressed.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file is explicitly an installer that can automatically fetch and install additional skills, which is materially broader than the declared purpose of a tax/accounting compliance assistant. Even though the code includes some safeguards such as zip-slip checks, it still creates a software supply-chain path where a tax-focused skill can modify the user's skill environment and introduce new code or prompts from external packages.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: This code resolves package sources, detects a channel, and downloads archives from external URLs at runtime, which enables remote content delivery unrelated to the stated tax advisory function. Any compromise of the manifest, download URL configuration, or remote distribution endpoint could cause the skill to import attacker-controlled content into the user's environment.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The default target points to the user's global ~/.skills directory, allowing this skill to persistently alter the local skill set outside its declared business purpose. Combined with later replacement logic, this gives the skill the ability to overwrite or add installed skills, increasing the blast radius of a malicious or mistaken package update.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The UI and consent text state that only non-identifying metric values are sent and that identity fields are excluded, but the code silently registers and persists a unique client/device identifier and API key, then transmits the client ID in headers to the remote service. This undermines the privacy representation and enables cross-session linkage of supposedly anonymous self-check submissions, which is especially sensitive in a tax/compliance workflow handling regulated business data.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The page tells users the workflow is local and non-uploading, yet the implementation performs remote registration/authentication and sends self-check data to a cloud API. This is a deceptive data-flow mismatch that can cause users to disclose sensitive tax/compliance information under false assumptions about locality and non-transmission.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The skill directs users to an external web page without clearly warning that they are leaving the local skill context for a third-party site. In a tax/compliance workflow, this can mislead users into entering sensitive corporate or personal financial information into an external service without adequate notice.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The primary interfaces transmit user tax questions and risk scenarios to remote services, and fallback logic may also send search queries to public search engines, but this file provides no user-facing notice or consent mechanism. Because the content can include sensitive tax, financial, or compliance facts, undisclosed transmission materially increases confidentiality and privacy risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: API credentials are written to a local JSON config file in the user’s home directory without any warning or stronger secret storage. Plaintext persistence of bearer credentials makes token theft easier through local compromise, backups, sync tools, or accidental disclosure, enabling misuse of the remote service identity.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Tool-call arguments received over stdin are forwarded verbatim to a remote cloud endpoint, but this file provides no explicit user-facing consent, redaction, or warning about off-host transmission. In this skill context, users may submit sensitive tax, accounting, ownership, or potentially personal/commercial data, so silent proxying materially increases confidentiality and compliance risk.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The contract review skill includes many generic single-word keywords such as broad business nouns that can match a large share of unrelated user prompts. In an agent-routing context, this can cause unintended invocation, misrouting sensitive user requests, and expansion of the skill's access surface beyond its intended scope.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The policy knowledge skill has an extremely broad keyword set spanning many tax, compliance, reporting, and business terms, making it effectively a catch-all router target. This can overshadow narrower skills, trigger on unrelated prompts, and increase the chance that sensitive user context is sent to a remote service not specifically intended for that workflow.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code stores a persistent client identifier and bearer API key in localStorage, where they are accessible to any script running in the page origin, including future injected scripts or compromised dependencies. In a tax/compliance context, theft of these values could allow unauthorized API use and tracking of user activity across sessions.

External Transmission

Medium

• Category: Data Exfiltration

Content

"slug": "tax-advisory-practice",
      "name": "财税中介机构AI合规咨询服务转型专题",
      "package": "tax-advisory-practice.zip",
      "download_url": "https://api.skillhub.cn/api/v1/download?slug=tax-advisory-practice",
      "is_core": false,
      "board": "B",
      "version": "3.15.3",

• Confidence: 94% confidence
• Finding: https://api.skillhub.cn/

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.