企业出海全球合规指引

• Outcome: Review
• Latest audit: Jul 28, 2026 · 5:08 AM UTC
• Version: 3.15.3

Overview

The skill provides the advertised compliance guidance, but it also includes remote service registration, local logging, client configuration changes, and matrix-wide skill installation paths that need review before use.

Install only if you are comfortable with a cloud-backed tax/compliance service that may send prompts or self-check metrics to mcp.aitaxs.top, store API keys and logs locally, and potentially install related skills or alter MCP client configuration when setup scripts are run. Review the installer and avoid running write-mode setup on managed or sensitive machines unless you have approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises no declared permissions, yet the static analyzer detected capabilities for environment access, file read/write, and network operations. That creates a significant trust and transparency gap: users may invoke a seemingly informational compliance assistant while it can modify local configuration, persist data, or contact remote services without explicit permission disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is a global compliance guidance assistant, but the observed behavior includes host-agent detection, local MCP configuration changes, remote API-key registration, local persistence, web-search fallback, and installation of other skills. This mismatch is dangerous because it masks privileged operational behavior behind a benign policy-advice description, preventing informed consent and enabling unexpected system changes or data exposure.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This initialization module performs host inspection and can alter local client configuration files, which materially exceeds the stated purpose of a tax/compliance guidance skill. Even if framed as convenience setup, this creates an installation/persistence capability that can silently change how the user's AI tooling connects to external services.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code fingerprints the local environment by inspecting environment variables, home-directory paths, and installed client layouts to infer which agent is running. For a compliance-reference skill, this capability is unnecessary and increases privacy risk while enabling tailored persistence or client-specific behavior.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This section writes and merges MCP configuration into user application settings for Claude Desktop, Cursor, and Cline, effectively installing or registering the service into other applications. That is a privileged local-side effect unrelated to the skill's declared business purpose and can redirect client behavior toward the configured endpoint without meaningful review.

Intent-Code Divergence

Medium

• Confidence: 80% confidence
• Finding: The documentation claims the module is not responsible for networking, yet it hard-codes a remote MCP service URL and configures clients to use it. That mismatch undermines informed consent and obscures the real security boundary, especially when combined with automatic client configuration.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The code hardcodes a remote MCP endpoint for a different service domain and exposes tools centered on tax-policy Q&A, risk checks, and tax calculation, which materially conflicts with the skill's declared purpose of global outbound compliance guidance. This creates a trust-boundary and transparency problem: user prompts and business scenarios may be sent to an unexpected third-party service, and the returned guidance may be outside the advertised compliance scope, causing sensitive data leakage and unsafe operational decisions.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The module docstring says the server exposes a cloud tool surface equivalent to the backend, but the named tools are inconsistent with the advertised global-compliance assistant. Misleading self-description is not just documentation drift here; it can cause operators and users to grant trust, access, or sensitive inputs under false assumptions about what service is actually being used.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The skill advertises itself as a compliance guidance assistant, but the embedded installer expands its capabilities to downloading and installing additional skills. That creates a software supply chain action path unrelated to the declared purpose, increasing the chance of silent package installation and abuse if the manifest or download sources are tampered with.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This code downloads zip archives and installs them into the user's skills directory, which is a privileged capability for a tax/compliance assistant. Even though it includes basic zip-slip checks, it still enables remote code/content introduction from manifest-controlled URLs and local sources, creating a supply-chain risk and potential persistence mechanism.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The installer probes for local ClawHub configuration files and CLI presence to infer the distribution channel, which is unnecessary for the stated compliance-advisory purpose and exposes environment reconnaissance behavior. Such host inspection can reveal local software/configuration state and is commonly part of adaptive delivery logic for payload installation.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The UI states that data is kept locally and not uploaded, but the workflow later sends collected self-check metrics to a remote API endpoint. This is a material transparency failure that can mislead users into disclosing compliance-sensitive business information under false assumptions about where processing occurs.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The consent dialog describes transmission of tax metric values such as R&D ratios, but this page actually sends global-compliance boolean self-assessment items. Even if the transmitted fields are not direct identifiers, misdescribing the nature of data sent undermines informed consent and can invalidate user expectations around sensitive compliance disclosures.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: The page includes generic functions for R&D hours, project document generation, ledgers, and ESOP checklists that are outside the declared purpose of a global compliance skill. Dormant or repurposable extra capabilities enlarge attack surface, increase maintenance risk, and make it easier for future content or DOM injections to invoke unintended business workflows or export sensitive data.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The comment says identity fields prefixed with q_* are never sent, yet later deep-analysis prompt and report generation incorporate the company name into clipboard-ready content intended for pasting into another agent. This creates a misleading privacy boundary: users may believe identity data stays isolated, while the workflow encourages onward disclosure through adjacent features.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: Overly broad trigger phrases for common tax and compliance questions increase the chance of unintended activation in unrelated contexts. In a skill that may also perform network, file, or installation actions, accidental invocation expands exposure by causing users to engage functionality they did not intend to run.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: Generic installation phrases such as requests to install related tax skills are ambiguous and can trigger package installation flows without sufficient scoping. Because the skill is described as supporting matrix-wide installs and related-skill installation, these phrases could be exploited for stealthy expansion of capabilities beyond what the user intended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code can directly modify user configuration files without an interactive confirmation at the moment of change. Although there is a dry-run default in some paths, the write-capable functions themselves impose no consent barrier, so callers or wrappers can trigger persistent disk changes silently.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: When executed as a script, the main entrypoint calls detect_and_setup with dry_run disabled, so running the file immediately attempts to write persistent configuration changes. This creates a sharp edge where mere execution causes installation-like side effects without a clear warning or consent flow.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The client writes configuration data containing the API key to a predictable file under the user home directory without encryption, permission hardening, or user disclosure. Local malware, other users on a shared system, backups, or support tooling could recover the credential and use it to access the remote service or impersonate the client.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code automatically registers with a remote service and transmits user/device identifiers without a clear user-facing consent flow. Even though the identifier is limited, silent outbound registration creates privacy and governance risk and may violate enterprise expectations around network egress and telemetry.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: User questions are logged to local files without sanitization, minimization, retention controls, or visible disclosure. In this skill’s compliance context, prompts may contain commercially sensitive tax, payroll, entity, or personnel information that could later be exposed through local compromise or routine file collection.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Risk scenarios are logged locally without warning, and those scenarios are likely to contain especially sensitive compliance facts such as suspected violations, tax exposures, AML/anti-corruption issues, or employee matters. Leakage of these records could create legal, reputational, and investigative harm beyond ordinary application logging.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The `_rpc` function forwards tool arguments over HTTP to a public cloud endpoint without any in-file user-facing notice, consent, redaction, or classification guardrails. Because this skill handles tax, employment, and compliance scenarios that can contain confidential corporate or personal data, silent exfiltration to a remote service increases privacy, regulatory, and contractual risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documented flow says the installer may be automatically executed from a conversational trigger, yet it performs network retrieval and writes extracted content into the skills directory. Auto-executing such side effects without a clear warning and confirmation undermines informed consent and makes stealthy installation of additional content more dangerous in this skill context.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.