ClawHub
Back to skill

Security audit

上市审核税务合规指引

Security checks across malware telemetry and agentic risk

Overview

This tax guidance skill is mostly tax-related, but it also includes cloud proxying, persistent credentials, host-client setup, and bulk skill installation behaviors that users should review before installing.

Review this skill before installing. It is suitable only if you are comfortable with a third-party cloud tax service receiving tax questions or self-check metrics, local storage of API credentials/client IDs/logs, and optional setup or installer flows that may modify MCP/client configuration or install related skills. Avoid entering highly sensitive IPO, corporate, or personal tax data unless the operator, retention terms, and endpoint are acceptable to you.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (62)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill presents as a documentation-only tax compliance assistant, yet the analysis indicates effective capabilities for environment access, file read/write, and network use without any declared permissions. Hidden or undeclared privileged behavior breaks user expectations and prevents informed consent, which is especially risky when the same skill also advertises automatic installation and cross-skill setup flows.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
This is a strong description-behavior mismatch: the skill claims to be a specialized IPO tax compliance guide, but reportedly modifies host MCP/client configuration, registers with remote services, obtains API keys, performs network fallback scraping, writes local state/logs, and acts as a generic MCP proxy/router. That combination creates supply-chain and stealthy persistence risk because a user seeking tax guidance would not reasonably expect host reconfiguration, credential provisioning, or broad system integration.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The file implements agent/environment detection, transport selection, and MCP registration logic for a different remote service ('tax-policy-knowledge' at mcp.aitaxs.top) than the declared IPO tax compliance assistant. This mismatch indicates hidden or repurposed capability that can silently connect the host to an unrelated service, violating least surprise and expanding the trust boundary beyond the stated skill purpose.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code inspects environment variables, home-directory contents, IDE folders, and transport characteristics to identify the host agent/client. For a tax compliance assistant, this host fingerprinting is unnecessary and increases privacy exposure while enabling environment-tailored persistence or behavior.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The module can write or merge MCP/IDE configuration into Claude Desktop, Cursor, and VS Code/Cline files, effectively installing or persisting a service on the user's machine. That is unrelated to a tax-audit assistant's declared purpose and creates a strong unauthorized-modification/persistence risk, especially because execution with TAX_ENABLE_AUTOSETUP=1 or __main__ can perform actual writes.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The docstring says the module is not responsible for networking, yet the code embeds a remote URL and chooses a cloud HTTP transport for some clients. This inconsistency can mislead reviewers and users about external connectivity, weakening informed consent and making hidden data flow to a third-party endpoint more likely.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The client automatically registers with a remote service and persistently stores an API key and device identifier in the user's home directory without any explicit consent or strong local secret protection. In a tax-compliance context, this creates unnecessary data exposure and credential-theft risk, especially on shared hosts or developer workstations where local files may be readable by other users or captured by backups.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
This wrapper advertises an IPO tax compliance assistant, but actually forwards tool calls to a generic remote tax-policy MCP service with broader capabilities. That mismatch can cause users or host agents to disclose sensitive IPO/tax data to a service outside the declared scope and weakens least-privilege and trust-boundary expectations.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The code performs automatic agent-environment detection/setup during startup, which is unrelated to core tax analysis functionality and expands the skill's behavior into host introspection and potential configuration changes. Even though comments suggest writes are gated by an environment variable, the hidden detection path increases attack surface and violates user expectations for a narrowly scoped stdio proxy.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The file is explicitly an installer that can fetch and install additional skills, which materially exceeds the declared role of a tax-compliance assistant. Even if intended as convenience functionality, it grants software deployment capability from within a domain-specific skill, expanding trust boundaries and enabling supply-chain risk if the manifest or URLs are tampered with.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The code inspects local ClawHub configuration and CLI presence to infer distribution channel, which is unrelated to tax analysis and reveals environment-awareness used to alter behavior. This increases the attack surface because the skill adapts to host state and may silently choose remote package sources based on local artifacts the user did not intend to expose.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
This code resolves local or remote ZIP packages and downloads them for installation into the user's skills directory, a powerful software installation capability unrelated to the stated skill purpose. Although it includes basic ZIP path traversal checks, it does not verify cryptographic signatures, trusted digests, or strict origin guarantees, so a compromised manifest, channel, or URL could deliver malicious code.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The installer removes any existing target skill directory and replaces it during installation, giving it local administrative control over user skill content. If the package source is malicious or mistaken, this can overwrite trusted local skills and persist unwanted functionality under expected skill names.

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The page tells users their data is 'saved locally, not uploaded', but the self-check path posts collected metrics to a remote API. Even though the code limits transmission to indicator values rather than explicit identity fields, this is still a data-flow mismatch that defeats informed consent and can expose sensitive business compliance data.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The footer implies data is sent only after user consent, but the code can automatically register a client and obtain an API key in the background before or as part of authenticated use. Even if the registration itself may not include the form's identity fields, silently creating a persistent client identifier and credential undermines the user's expectation that nothing remote happens before explicit agreement.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
A tax compliance self-check page includes automatic client registration, persistent localStorage identifiers, and long-lived API credential storage that are not necessary for a simple browser-side workflow. This expands the attack surface: XSS or other browser compromise could steal the stored bearer token, and persistent identifiers enable tracking across sessions.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The markdown actively encourages users to open an external web page for self-checks and risk scanning, but does not clearly warn that they are leaving the chat context or that business/tax data entered there may be transmitted to an external site. In a tax/IPO compliance context, users may input highly sensitive corporate, cross-border, and pre-listing information, making insufficient disclosure materially risky.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The public functions log user tax questions, scenarios, and calculation metadata locally, while the same operations also send content to remote services, but the operational flow provides no clear user-facing notice or consent checkpoint. Because tax scenarios often contain sensitive financial or corporate information, undisclosed transmission and persistence can lead to confidentiality exposure through local log access, endpoint compromise, or routine log collection.

Missing User Warnings

Low
Confidence
82% confidence
Finding
Automatic registration sends a generated client identifier to a third-party service without a user warning or opt-in in the normal code path. While the identifier is not a strong hardware fingerprint, it still enables correlation of activity across sessions and may surprise users in a sensitive tax-assistance workflow.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
All tool-call arguments are serialized and sent to an external HTTPS endpoint without any in-file consent, warning, minimization, or redaction. In an IPO tax compliance context, those arguments may contain highly sensitive corporate, financial, and cross-border tax information, so silent exfiltration to a third-party service creates a significant confidentiality and compliance risk.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The action path performs authenticated cloud self-check behavior without a clear in-context warning at the moment the user initiates the check. The consent modal helps, but the page also contains conflicting statements about local-only processing, making the warning insufficient and potentially misleading in practice.

External Transmission

Medium
Category
Data Exfiltration
Content
"slug": "tax-advisory-practice",
      "name": "财税中介机构AI合规咨询服务转型专题",
      "package": "tax-advisory-practice.zip",
      "download_url": "https://api.skillhub.cn/api/v1/download?slug=tax-advisory-practice",
      "is_core": false,
      "board": "B",
      "version": "3.15.3",
Confidence
93% confidence
Finding
https://api.skillhub.cn/

External Transmission

Medium
Category
Data Exfiltration
Content
"slug": "tax-capital-reduction",
      "name": "减资撤资（未实缴减资）个人所得税财税合规专题",
      "package": "tax-capital-reduction.zip",
      "download_url": "https://api.skillhub.cn/api/v1/download?slug=tax-capital-reduction",
      "is_core": false,
      "topics": [
        "减资",
Confidence
93% confidence
Finding
https://api.skillhub.cn/

External Transmission

Medium
Category
Data Exfiltration
Content
"slug": "tax-compliance-dispute",
      "name": "合规争议财税专题",
      "package": "tax-compliance-dispute.zip",
      "download_url": "https://api.skillhub.cn/api/v1/download?slug=tax-compliance-dispute",
      "is_core": false,
      "topics": [
        "财税内审",
Confidence
93% confidence
Finding
https://api.skillhub.cn/

External Transmission

Medium
Category
Data Exfiltration
Content
"name": "建筑施工行业财税合规专题",
      "slug": "tax-construction",
      "package": "tax-construction.zip",
      "download_url": "https://api.skillhub.cn/api/v1/download?slug=tax-construction",
      "is_core": true,
      "topics": [
        "建筑施工",
Confidence
93% confidence
Finding
https://api.skillhub.cn/

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.