行业涉税风险图谱指引

• Outcome: Review
• Latest audit: Jul 28, 2026 · 5:09 AM UTC
• Version: 3.15.3

Overview

The skill is a useful tax-risk assistant, but it also includes under-disclosed cloud calls, local credential/log storage, client configuration setup, and bulk skill installation capabilities.

Install only if you are comfortable with tax questions, scenarios, and self-check metrics being sent to mcp.aitaxs.top and, in fallback cases, possibly to public search engines. Avoid entering highly confidential taxpayer, employee, transaction, or account details. Do not enable TAX_ENABLE_AUTOSETUP or run the matrix installer unless you intentionally want local MCP config changes or bulk skill installation, and review/delete ~/.tax-policy-client logs and browser localStorage if using shared machines.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (68)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares itself as a documentation-only tax risk guide, yet the analyzer detected environment access, file read/write, and network capabilities with no explicit permission declaration. That combination creates hidden attack surface: a user or host may trust the skill as informational content while it can modify local state, access files, or communicate externally without transparent consent boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a strong description-behavior mismatch: the skill is presented as a narrow industry tax-risk advisory tool, but the detected behavior includes host fingerprinting, editing MCP client configs, remote API key registration, local persistence, fallback web search, and installation/routing of other skills. Hidden configuration changes, credential lifecycle actions, and downloader/installer behavior are especially dangerous because they can expand control beyond the user’s expectation and enable supply-chain compromise or stealthy persistence.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The initialization path can detect the host agent type and, when invoked with dry_run=False or via the TAX_ENABLE_AUTOSETUP environment variable, modify local MCP client configuration files. That behavior is unrelated to the stated tax-risk analysis purpose, expands the skill's control over the host environment, and can silently persist a remote service endpoint or local bootstrap server into user tooling.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code enumerates environment variables, home-directory client folders, VS Code extensions, and stdin characteristics to fingerprint which agent is hosting the skill. While not exfiltrating by itself, this host reconnaissance is unnecessary for a tax analysis assistant and creates a foundation for targeted persistence or behavior changes based on the user's local setup.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module presents itself as initializing the current skill, but the embedded constants point to a different service slug and endpoint ('tax-policy-knowledge' rather than the declared tax-industry-tax-risk skill). This mismatch undermines trust, increases the chance of silently routing users to an unintended remote service, and suggests the setup code is being reused in a way that bypasses clear user expectations.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file presents itself as a narrowly scoped industry tax-risk assistant, but actually exposes broader tax-policy Q&A, tax calculation, and knowledge-base capabilities. This scope drift can bypass user and platform expectations, causing the agent to access or provide functionality that was not disclosed or reviewed for this skill’s declared purpose.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: When the remote service fails, the client silently falls back to querying public search engines, which is behavior not described in the skill metadata. This creates an undeclared data egress path where user questions may be sent to third-party services, potentially exposing sensitive tax or business scenarios.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The generic scraping and parsing logic for Bing and Baidu gives the skill a broader web-search capability than its specialized tax-risk role suggests. In this context, the main danger is uncontrolled outbound requests and retrieval of unvetted content, which can leak user input and reduce trust in bounded, domain-specific behavior.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module documentation claims it 'only exposes' four safe tools, but the code also performs registration, health probing, local persistence, and external web access. Misrepresenting effective behavior undermines security review and can hide additional attack surface, especially in agent environments where declared scope is relied upon for trust decisions.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The file implements a generic proxy to a remote 'tax-policy-knowledge' MCP service rather than a narrowly scoped industry tax-risk specialist described by the skill metadata. This capability mismatch is dangerous because users and host agents may grant trust, permissions, or data access based on the declared purpose, while the actual code exposes a broader remote service surface and different behavior than expected.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The hardcoded SERVICE_URL points to a different remote service namespace ('tax-policy-knowledge') than the declared 'tax-industry-tax-risk' purpose. That inconsistency can mislead reviewers and users about what backend is actually processing requests, increasing the risk of unauthorized data sharing, unexpected outputs, or trust-boundary violations.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code performs local agent detection/setup logic unrelated to simple stdio request proxying, and may alter local configuration when TAX_ENABLE_AUTOSETUP is enabled. This expands the skill's behavior beyond its stated tax-risk function, creating an unnecessary local side-effect surface that could modify agent environments or persistence settings without clear user intent.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file is an installer that can fetch and install additional skills, which materially exceeds the declared purpose of a tax-risk analysis assistant. Even if framed as convenience functionality, this expands trust boundaries to network retrieval and local package deployment, enabling supply-chain abuse or unexpected capability expansion if the manifest or URLs are compromised.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code resolves package sources, downloads zip archives over the network, and installs them into the local skills directory. That creates a direct supply-chain and local persistence path: a compromised manifest, malicious URL, or tampered package can cause untrusted code/content to be placed on disk and later executed or trusted by the host environment.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The channel-detection logic inspects local configuration paths and CLI presence to infer whether ClawHub is installed. While not immediately code-executing, it performs environment discovery unrelated to the tax-analysis purpose and can leak or leverage host-specific state to alter behavior, increasing stealth and reducing user awareness of what source will be contacted.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The page tells users enterprise basic data is kept locally and not uploaded, yet the script provisions a persistent client ID/API key and sends self-check metrics to a remote API. Even if identity fields are excluded from the request body, this is still a trust-boundary and transparency failure because the browser stores identifiers and transmits sensitive tax-risk assessment data off-device.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill silently performs backend registration and persists an API key/client identifier in localStorage for a tax self-check UI, which expands the attack surface beyond the stated function of the page. Persistent credentials in browser storage are accessible to any script running in the origin, so compromise of the site or injected script could expose the key and enable unauthorized API use or tracking.

Description-Behavior Mismatch

High

• Confidence: 89% confidence
• Finding: The file contains substantial unrelated helper logic for R&D hours, ESOP/project/ledger exports, and similar off-scope functions that do not belong to an industry tax-risk skill. Dead or misplaced code increases maintenance risk, hides unexpected behavior, and can create accidental data handling paths or future abuse opportunities that reviewers and users would not expect in this context.

Intent-Code Divergence

Low

• Confidence: 82% confidence
• Finding: The consent dialog describes transmitted data using examples unrelated to this skill, which means users are not accurately informed about what tax-risk metrics are actually being sent. In a compliance-focused workflow, misleading consent language undermines informed consent and may cause users to disclose sensitive operational data under false assumptions.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: An overly broad trigger for a 'self-check' can cause the skill to activate in situations broader than the user intended, especially in a compliance context where outputs may look authoritative. In isolation this is not severe, but combined with the detected hidden capabilities and broader-than-described behavior, loose activation increases the chance of unintended execution paths, remote calls, or side effects.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The markdown explicitly says a broad phrase can trigger a full-industry check, but does not define the operational boundary, data handling, or whether external services are contacted. That ambiguity is risky because users may think they are asking for harmless guidance while actually initiating a more expansive workflow, especially given the analyzer’s indication of network, file, and configuration capabilities elsewhere.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Configuration files for Claude Desktop, Cursor, and Cline can be modified by code paths that do not present an inline warning at the write site; execution under __main__ even calls detect_and_setup(dry_run=False). Even with a nominal dry-run default elsewhere, this creates a realistic risk of silent persistence into user developer tools without contemporaneous consent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The client automatically registers with a remote service and stores API credentials locally without user-facing notice or confirmation. In a tax-risk assistant, this is more dangerous because it creates persistent external linkage and credential material on disk that users may not expect, increasing privacy and secret-handling risk on shared systems.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The logging function writes user questions and risk scenarios to local JSONL log files without disclosure, and those inputs may contain sensitive tax, employment, transaction, or compliance details. Because this skill is designed for potentially confidential business tax-risk analysis, silent local logging materially increases privacy exposure and forensic leakage on multi-user or unmanaged endpoints.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The _rpc function sends user-supplied tool arguments over the network to a remote MCP endpoint, but this file provides no user-facing disclosure, consent prompt, or local notice about that transmission. In a tax-related skill, inputs may contain sensitive business, financial, or personal data, so silent forwarding to a third party increases privacy and compliance risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.