社保入税与社保合规指引

• Outcome: Review
• Latest audit: Jul 28, 2026 · 6:06 AM UTC
• Version: 3.15.3

Overview

The skill provides social-insurance compliance help, but it also includes under-disclosed remote service registration, persistent MCP configuration changes, and a bulk skill installer that are broader than the advertised task.

Install only if you are comfortable with this skill using a remote tax-policy service, storing local API/client identifiers, and potentially adding persistent MCP configuration or installing additional tax skills when invoked. Review the exact endpoint and installer behavior first, avoid entering personal payroll identifiers or confidential business details unless approved, and prefer dry-run/manual setup for any matrix installation or MCP configuration change.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (66)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions, yet the analyzed behavior indicates access to environment data, local files, file modification, and network connectivity. This creates a transparency and consent gap: users may invoke a seemingly informational compliance skill without realizing it can alter local MCP configuration, read local state, or contact remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a narrowly scoped social-insurance compliance assistant, but the detected behavior is materially broader: it connects to a general remote tax-policy service, performs generic risk checks/calculations, writes or merges MCP client configuration, installs related skills, and may fall back to public web search. This mismatch is dangerous because users cannot make informed trust decisions, and the hidden installation/routing/config-writing behavior expands the attack surface well beyond the declared purpose.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The code’s behavior is materially unrelated to the declared tax/social-insurance compliance purpose: it fingerprints the host agent environment, selects a remote MCP endpoint, and can persistently modify client configuration to register that endpoint or a local proxy. This creates a covert installation/bootstrap mechanism that expands execution and communication paths without a business-justified need, which is especially suspicious in a skill whose advertised function is domain advice rather than agent reconfiguration.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file-writing routines can modify multiple local client configuration files under the user’s home directory, adding MCP server entries that persist beyond the current session. Persistent config tampering is dangerous because it can silently redirect future agent activity to attacker-controlled or unreviewed services, and the capability is disproportionate to a social-insurance compliance assistant’s stated role.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module claims it does not introduce new network endpoints, yet it hardcodes a remote MCP service URL and prepares client configs to connect to it over HTTP. Misleading documentation around remote connectivity undermines informed trust decisions and can hide exfiltration, remote control, or dependency risks from reviewers and users.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The comments state the default behavior is detection and logging only, but the __main__ path invokes detect_and_setup(dry_run=False), causing attempted persistent configuration changes when run directly. This mismatch is dangerous because it defeats reviewer expectations and can trigger unintended system modification under the guise of a harmless probe.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements a broad generic tax-policy cloud client, not a narrowly scoped social-insurance compliance assistant as described in the skill metadata. This capability mismatch expands data flows, remote functionality, and user trust assumptions, creating a confused-deputy risk where users may unknowingly send sensitive employment, tax, and compliance data to a broader external service than the skill claims.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The fallback code performs arbitrary public web searches against Bing and Baidu, which is outside the specialized social-insurance scope and not obviously disclosed to users. Queries may contain sensitive compliance facts, and sending them to third-party search engines can leak confidential business information while also returning untrusted content into the skill workflow.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The module documentation states that only approved safe cloud tools are exposed, but the implementation also includes undocumented external web-search fallback. This misleading security claim can cause reviewers and users to underestimate the actual attack surface and data-sharing behavior, weakening informed consent and security review effectiveness.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill advertises itself as a social-insurance compliance assistant, but hardcodes requests to a general tax-policy cloud endpoint. That creates a trust-boundary and capability-mismatch problem: user inputs intended for a narrow domain may be transmitted to a broader remote service with different processing, retention, or response behavior than users expect.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The exposed tools are tax-policy oriented and do not match the manifest's promised social-insurance-specific functions. This mismatch can mislead users and calling agents into sending sensitive payroll, employment, and compliance data under false assumptions about specialization, correctness, and least-privilege behavior.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The module documentation explicitly describes a tax-policy MCP proxy, contradicting the skill's manifested identity as a dedicated social-insurance assistant. In security terms, misleading identity and documentation weaken informed consent, increase the chance of inappropriate data disclosure, and make downstream policy enforcement by agents harder.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This installer enables bulk installation of additional skills and supports downloading remote packages, behavior that materially exceeds the declared purpose of a social-insurance compliance assistant. Even though the code includes some safety checks such as zip-slip validation, it still expands the trust boundary by fetching and installing executable skill content from external sources, which can be abused for supply-chain compromise or unauthorized capability expansion.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code probes the local environment for ClawHub configuration and binaries, then selects a remote download channel and retrieves packages accordingly. For a tax/social-insurance assistant, this kind of environment inspection and external package acquisition is unnecessary and increases risk by collecting execution-context signals and enabling remote content delivery into the user's skills directory.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The offline workflow is materially misaligned with the skill’s declared purpose: the manifest promises social-insurance compliance assistance, but the file implements generic tax-compliance steps and tax tooling references instead. In a compliance skill, this scope confusion can cause users to rely on inapplicable guidance, miss social-insurance-specific obligations, and make incorrect remediation or filing decisions.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The risk engine classifies unrelated tax/corporate scenarios such as equity transfers, capital reductions, liquidation, and cross-border restructuring, which are outside the stated social-insurance scope. That broad but mismatched analyzer can mislead users into believing the skill has assessed social-insurance risk when it has actually screened for different legal and tax issues, creating dangerous false assurance and omitted-risk conditions.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The page claims the workflow is 'local' and 'not uploaded', but it actually posts user-entered compliance metrics to a remote API and silently auto-registers an API client. This is a transparency and data-handling flaw because users may disclose sensitive compliance data under a false understanding of where processing occurs.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The consent text says no identity fields are included, but the code creates and persists a client/device identifier in localStorage and sends it during registration and subsequent API calls. Even if company name is excluded from the metrics payload, persistent identifiers can still enable correlation of sessions and weaken the privacy assurances presented to users.

Context-Inappropriate Capability

High

• Confidence: 89% confidence
• Finding: The file contains unrelated code paths for R&D hours analysis, ESOP/checklist copying, and project document generation that do not belong in a social-insurance compliance assistant. Extra dormant capabilities enlarge the attack surface, increase review difficulty, and create opportunities for hidden or unintended data processing in a tool users would reasonably trust to be narrowly scoped.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger guidance encourages activation from broad intent phrases such as self-check or risk-check requests, causing the skill to engage in contexts that may be only loosely related to this topic. In a skill with remote-link promotion and broader-than-declared capabilities, ambiguous activation increases the chance of unintended execution paths and user exposure to external services.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The installation phrases are highly generic, such as requests to install a full tax skill matrix or related skills, which can match ordinary user requests and trigger broad ecosystem changes. Because the surrounding skill appears capable of writing MCP configuration and onboarding additional packages, these broad triggers can lead to unexpected installation or configuration mutation beyond the user's immediate intent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The client automatically registers with a remote service and sends device_id and user_id values without any visible runtime notice or consent in this file. Even if identifiers are pseudonymous, this creates undisclosed outbound telemetry and account linkage that may violate privacy expectations for a compliance-focused skill handling sensitive enterprise data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: User questions and risk scenarios are sent to remote MCP tools without an in-band disclosure at the point of use. In this skill context, prompts may contain payroll, labor, tax, and social-insurance compliance details, so silent transmission to a third party increases confidentiality and privacy risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code forwards tool inputs over HTTP(S) to a remote cloud service without any user-facing warning in the main execution flow. Because this skill's context involves potentially sensitive tax, payroll, labor, and social-insurance compliance data, silent transmission to a third-party service increases confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The comments and control flow indicate that the installer may be triggered from a conversational request and then automatically download and install related skills without an execution-time confirmation step. That creates a risky surprise side effect: a user asking for help from a compliance assistant could indirectly authorize filesystem writes and network retrieval of additional packages.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.