Tax Esop Platform

• Outcome: Review
• Latest audit: Jul 24, 2026 · 12:19 PM UTC
• Version: 3.14.34

Overview

The skill is a tax/ESOP assistant, but it needs Review because it sends sensitive tax content to cloud and search services and can modify local MCP client configuration without clear enough user-facing disclosure.

Install only if you are comfortable with sensitive tax and equity questions being sent to the provider's cloud service, and with possible fallback searches to public search engines. Review or disable the MCP auto-setup path before running config/init_agent.py directly, and avoid entering confidential company, cap-table, payroll, or personal tax details unless your organization has approved this provider and its retention practices.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The manifest is presented as a narrowly scoped ESOP/tax-compliance skill, yet the detected capabilities include environment access, file read/write, and network use without declared permissions. That creates a major transparency and least-privilege problem: a user or host may authorize the skill under false assumptions while it can modify local configuration, access local data, or transmit information externally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a serious scope-deception issue: the skill claims to be an ESOP tax assistant, but the described behavior includes host-agent detection, MCP configuration changes, remote service connection, API key registration, fallback web searching, and broad tax/compliance functions outside the declared purpose. Such hidden or under-declared behavior can be used to gain persistence, route user queries to remote infrastructure, and perform actions the user did not knowingly authorize.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: A skill marketed as a single ESOP compliance assistant also advertises the ability to auto-download and install an entire 20-skill matrix. That expands trust boundaries significantly and can lead to unreviewed code or capabilities being introduced through transitive installation, increasing attack surface beyond what the user expected.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Cross-skill recommendation, automatic switching, and one-click installation are materially broader orchestration features than a specialized ESOP advisory tool needs. In practice, these mechanisms can funnel users into other skills or capabilities with different data handling, permissions, or remote dependencies, undermining user understanding and consent.

Intent-Code Divergence

Low

• Confidence: 76% confidence
• Finding: The privacy statement makes an absolute claim that no device or personal data is collected, while the same manifest references random identifiers, service calls, and web-based interactive pages. Even if no malicious collection is intended, contradictory privacy claims can mislead users about what telemetry, identifiers, or request metadata may be transmitted.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The module’s stated purpose and behavior are mismatched: instead of performing tax/ESOP compliance tasks, it identifies the host agent type and prepares to alter local MCP client configuration to register a remote service. This is dangerous because it expands the skill’s privileges into host-environment reconnaissance and persistence-like configuration changes that are unrelated to the declared business function, increasing the risk of covert integration or unauthorized data routing.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This code probes environment variables, filesystem layout, editor directories, and stdin characteristics to fingerprint the host environment, then uses that information to decide how to attach the skill. In the context of a tax compliance assistant, this capability has no clear legitimate necessity and is dangerous because it enables stealthy adaptation to the host and targeted modification of developer/agent tooling configuration.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documentation claims the module defaults to detection and logging without writing to disk, but the script entry point invokes detect_and_setup(dry_run=False), causing actual configuration attempts when executed directly. This discrepancy is dangerous because operators may trust the documentation and run the script expecting a harmless dry run, leading to unintended modification of local MCP/client settings.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The server routes all tool calls to a remote cloud MCP endpoint, which expands the trust boundary beyond the local skill package and creates data exfiltration and supply-chain risk. For a tax/ESOP compliance assistant, users may submit sensitive corporate, payroll, cap-table, or listing-readiness information that is transmitted off-host to an external service not transparently enforced or consented to at call time.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Startup code imports and runs agent/environment detection with optional local setup behavior unrelated to simple stdio proxying. Even if gated by an environment variable, hidden environment probing and potential filesystem/config side effects increase attack surface and can modify the host agent setup in ways users may not expect from a tax-policy tool.

Intent-Code Divergence

Low

• Confidence: 82% confidence
• Finding: The file claims it is stateless and does not retain private enterprise data, but the generated report includes caller-supplied company names and appends an external promotional link/contact block. Even if no server-side persistence occurs in this file, embedding user-provided identifiers into distributable output increases privacy and data-handling risk and makes the claim materially misleading.

Description-Behavior Mismatch

Low

• Confidence: 89% confidence
• Finding: The report generator injects a marketing footer, external URL, and direct contact information into what should be a professional compliance output. In a tax/compliance skill, this creates a trust-boundary violation: downstream users may unknowingly distribute third-party links or contacts inside sensitive deliverables, which is inappropriate and can facilitate phishing, unwanted disclosure, or policy bypass in regulated workflows.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The UI states that data is kept locally and not uploaded, but the page contains cloud submission logic via fetch(API + "/topic_selfcheck"). Even if the code attempts to send only non-identity metrics after consent, the contradictory privacy claim can mislead users into sharing sensitive tax/compliance inputs under false assumptions, which is a privacy and trust violation.

Vague Triggers

Medium

• Confidence: 73% confidence
• Finding: Overly broad trigger phrases can cause the skill to activate in contexts beyond its intended ESOP scope, especially when combined with the broader undeclared behaviors noted elsewhere. Unintended invocation increases the chance that user data or queries are routed into remote or higher-privilege workflows without clear intent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code logs user-provided tax questions/scenarios and sends them to remote services, but there is no user-facing notice or consent flow. Because tax and equity-incentive scenarios often contain sensitive financial, employment, and compliance details, silent transmission and local persistence can expose confidential business information or personal tax data.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: When the remote service is unavailable, the client automatically submits user queries to Bing/Baidu without disclosure or consent. In this skill context, user inputs may contain highly sensitive tax, cap-table, ESOP, nominee-holding, or pre-IPO compliance facts, so forwarding them to third-party search engines materially increases confidentiality and regulatory risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code transmits request payloads over the network to a third-party cloud endpoint without any user-facing disclosure or consent flow in this file. In the context of tax, ESOP, and compliance workflows, inputs may contain highly sensitive financial, employment, ownership, and regulatory information, making undisclosed outbound transmission materially risky.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.