Security audit

数电票合规与空壳虚开防范指引

Security checks across malware telemetry and agentic risk

Overview

The skill has a coherent tax-compliance purpose, but it also adds broad remote-service, local persistence, MCP setup, and bulk skill-install behavior that users should review before installing.

Review this skill before installing in a sensitive or managed environment. It may send tax questions, scenarios, and self-check metrics to mcp.aitaxs.top, may fall back to public search engines, stores credentials and logs locally under ~/.tax-policy-client, and includes tooling that can bulk-install related skills into ~/.skills. Avoid entering confidential invoice, supplier, or dispute details unless those data flows are acceptable, and do not enable TAX_ENABLE_AUTOSETUP or run installer/setup scripts unless you want persistent MCP or skill-install changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (66)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares no permissions, yet the content indicates capabilities consistent with environment access, file read/write, and outbound network use. That mismatch is dangerous because it defeats informed consent and can allow configuration changes, remote data exchange, or local file access beyond what a user would reasonably expect from a tax-compliance guidance skill.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This is a substantial description-behavior mismatch: the skill presents itself as a narrow invoice-compliance assistant, but the described behavior includes auto-detecting host agents, editing client MCP configuration files, registering with remote services for API keys, using cloud services, performing web-search fallback, logging/caching locally, and installing or routing to other skills. Such hidden breadth materially expands the attack surface and can lead to unauthorized persistence, data exfiltration, cross-skill privilege expansion, and user deception.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The code hard-codes a remote service slug and name for a different capability ('财税政策知识库') than the advertised skill ('数电票合规与空壳虚开防范'), indicating hidden or mismatched functionality. In a skill package, this kind of capability substitution can misroute user data and silently connect the host to an unrelated backend, which is dangerous because users and reviewers cannot rely on the declared scope.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This code fingerprints the host environment by detecting installed agents and editor state, then uses that information to decide how to integrate itself. That behavior is not necessary for invoice-compliance analysis and expands the skill's privilege surface into local environment discovery, which can facilitate unauthorized persistence or stealthy integration paths.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The module can persistently modify Claude, Cursor, and VS Code/Cline MCP configuration files, effectively registering a new service in developer tools. Persistent configuration changes are high risk in a business-analysis skill because they survive the current session, may be unexpected by the user, and can establish long-lived access to a remote endpoint or local proxy.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The comments claim the module only reuses a sanctioned endpoint, but the actual hard-coded endpoint and service identity belong to a different service than the current skill. This mismatch undermines reviewer trust and can conceal unauthorized data flow to an unintended backend, especially when paired with auto-registration logic.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The file exposes a general-purpose remote tax-policy/search client, including broad policy Q&A, risk checks, tax calculation, and fallback search, which exceeds the declared narrow invoice-compliance purpose. This scope expansion increases the attack surface and can cause users or downstream agents to send unrelated sensitive tax/business data to external services under the assumption they are using a specialized compliance helper.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The fallback path performs live web searches against public search engines and parses returned HTML, but this behavior is not disclosed in the skill description. User questions may contain sensitive invoice, supplier, or tax-risk details, so silently transmitting them to third-party search providers creates an unintended data exfiltration/privacy risk and introduces untrusted content into responses.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The client automatically registers with an external service, generates/persists a device identifier, and stores API credentials locally without explicit user approval tied to the skill's stated purpose. This creates persistent identity tracking and local credential exposure risk, and it can silently establish external accounts and outbound data flows in environments where such behavior is unexpected or prohibited.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The skill advertises a specialized tax-invoice-compliance function, but the code exposes a generic cloud tax-policy MCP proxy instead. This creates a capability/intent mismatch: user prompts and sensitive business data may be sent to a broader remote service than expected, increasing data exposure and weakening trust boundaries for a compliance-focused skill.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: Initialization performs agent detection and may trigger local setup behavior unrelated to invoice-compliance analysis. Even though comments say writes depend on an environment variable, host-environment inspection and optional setup expand the skill's behavior beyond its stated purpose and can surprise users or alter local agent configuration.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code includes host-agent detection and optional environment setup capability that is not justified by the business purpose of tax invoice compliance assistance. Such environment-aware behavior increases attack surface because it can be repurposed to fingerprint the host, adapt behavior to the client, or make persistence/configuration changes under a trusted skill context.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The module docstring presents the component as a generic tax-policy MCP server, which conflicts with the manifest's specialized tax-invoice-compliance identity. This mismatch can mislead users and reviewers about actual capabilities and data flows, making it easier to conceal overbroad remote access or tool exposure behind a narrower business description.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file is an installer whose stated purpose is to automatically fetch and install additional skills, which materially expands the capability of a tax-invoice compliance assistant into package management. Even though it includes some safety checks such as zip-slip validation, it still creates an unnecessary software supply-chain path that can introduce unreviewed code or content into the user's environment.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: This code resolves package locations from local sources or remote URLs and downloads zip archives for installation, which enables remote code/content delivery unrelated to the advertised business purpose. Because the download targets are driven by manifest data and the installer proceeds to extract and install them locally, compromise of the manifest or distribution endpoint could lead to supply-chain abuse and unauthorized capability expansion.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The installer probes for local ClawHub configuration files and CLI presence to infer the user's environment, which is outside the expected scope of invoice-compliance assistance. While not directly exfiltrating data, this host inspection expands environmental awareness and can be used to tailor follow-on installation behavior, increasing the risk profile of the skill.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The UI claims the data is 'local only' and 'not uploaded', but the code later performs remote API key registration and sends self-check metrics to a cloud endpoint after consent. This is a true transparency and data-handling vulnerability because users may rely on a false privacy representation when entering sensitive tax compliance information.

Context-Inappropriate Capability

High

Confidence: 89% confidence
Finding: The file contains unrelated capabilities for R&D hours analysis, project generation, auxiliary ledger export, and ESOP step copying inside a tax invoice compliance skill. Even if not all are reachable in this page, bundling unrelated business logic increases attack surface, creates maintenance confusion, and raises the risk of unintended exposure or activation of code paths users do not expect.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The consent text says transmitted data will be examples like R&D expense ratios and staffing ratios, but this page actually sends invoice-compliance indicators. Misstating the nature of transmitted data undermines informed consent and can cause users to approve processing under false assumptions.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger list includes broad operational phrases such as installing related skills and general tax questions, which can overlap with ordinary conversation and invoke the skill unexpectedly. In this context, accidental activation is more dangerous because the same skill also advertises link pushing, cross-skill installation, and broader remote behaviors, increasing the chance of unintended actions or disclosures.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The instruction to proactively provide a clickable external link whenever the model detects related intent is too ambiguous and creates an automatic outbound redirection path. That is risky because the activation threshold is undefined, allowing unsolicited link delivery to an external site that may collect data or steer users into workflows they did not explicitly request.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The code writes configuration and state files locally without contextual disclosure at the operation point, including cached health/config state under the user's home directory. In a tax-compliance context, silent persistence can surprise users, leave traces in managed environments, and expose operational metadata to other local users or processes.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The client automatically performs outbound registration and later transmits identifiers and user questions/scenarios to a remote service without visible, operation-time disclosure. Because this skill handles tax invoice compliance and fraud-risk scenarios, the transmitted content may contain highly sensitive business, supplier, invoice, and legal-risk details, making silent external transfer particularly dangerous.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Tool-call arguments are forwarded over HTTP(S) to a cloud endpoint, but this file provides no runtime notice, consent gate, or redaction controls for potentially sensitive tax/compliance data. In this skill context, users may submit invoices, contract details, counterparties, and risk scenarios, so silent transmission to a third party materially increases confidentiality and compliance risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code path automatically registers an API key and sends cloud self-check requests, while the network behavior is not clearly surfaced at the point where registration occurs. Automatic credential issuance plus remote transmission can surprise users and weakens trust boundaries, especially in a tax compliance workflow handling operationally sensitive data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.