tax-govsubsidy

• Outcome: Review
• Latest audit: Aug 1, 2026 · 5:19 PM UTC
• Version: 3.15.7

Overview

The skill is a tax-compliance helper, but it needs Review because it can send sensitive tax questions to a cloud service, store local credentials/logs, and includes broad integration behavior that is not fully disclosed.

Install only if you are comfortable with tax questions, scenarios, and self-check metrics being processed by the mcp.aitaxs.top cloud service and with local storage of an API key plus logs under ~/.tax-policy-client. Avoid entering identifiable or highly sensitive business details unless necessary, review any prompt to install the broader tax skill matrix, and do not run autosetup/config scripts unless you want MCP client settings modified.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no permissions, yet the content and linked behaviors indicate capabilities such as network access, local file/config modification, and possible environment access. That creates a transparency and consent gap: users may install a seemingly narrow tax-compliance skill without understanding that it can reach external services or alter local configuration, which materially increases attack surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This is a serious description-behavior mismatch: the skill is presented as a focused government-subsidy compliance guide, but the detected behavior includes remote MCP connectivity, API-key registration/storage, host-agent detection, local MCP config writes, broader tax tooling, web-search fallback, and local logging/cache. A user evaluating a domain-specific compliance helper would not reasonably expect installer-like system integration and external service brokerage, making informed consent impossible and enabling overbroad access to local and business-sensitive data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill encourages users to open an external self-check webpage and potentially paste business compliance information there, but it does not clearly warn that the user is leaving the chat boundary or that sensitive enterprise data may be transmitted to a third-party site. In a tax/compliance context, the prompted data can include highly sensitive financial, operational, and regulatory information, so this omission meaningfully increases disclosure risk.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: Advertising one-click installation of a full skill bundle or related skills without a clear capability-diff or scope warning can cause users to authorize far broader functionality than intended. Because the broader matrix appears capable of installation, cross-topic routing, and potentially external integrations, this can expand permissions and data exposure beyond the narrow government-subsidy scenario the user selected.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The client logs raw user-supplied tax questions and risk scenarios to local JSONL files via `_log(...)` calls, including fields such as `question` and `scenario`. In this skill’s tax-compliance context, those inputs can contain sensitive business, financial, or investigatory details, so persisting them without minimization, redaction, retention controls, or an explicit user-facing notice creates a real privacy and data-exposure risk on the local host.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This stdio server transparently forwards all tool calls and their arguments to a remote cloud MCP endpoint, which can expose user prompts, business data, or tax-sensitive information outside the local execution boundary. The issue is not the proxying itself, but the lack of an explicit in-band warning, consent flow, or clear local disclosure in code behavior, which increases the risk of unintentional data exfiltration in deployments that appear local to the user.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The offline risk detection logic relies on Chinese-only keywords and scenario aliases, while the surrounding interface and messages are partly in English. In practice, English or mixed-language user inputs may bypass keyword and scenario matching and incorrectly receive a LOW-risk result, which is especially problematic in a tax-compliance tool that users may rely on for triage when online services are unavailable.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.