Security audit

国有企业经济责任审计涉税风险与合规专题

Security checks across malware telemetry and agentic risk

Overview

The skill is a real tax-audit assistant, but it also sends sensitive audit prompts to remote services, persists local credentials/logs, can alter MCP client setup, and can bulk-install other skills.

Install only if you are comfortable with a cloud-backed tax service receiving audit questions or risk scenarios, local plaintext logs being created, and optional matrix installation adding other skills. Avoid entering confidential taxpayer, SOE investigation, supplier, reimbursement, or personnel details unless your organization approves the remote endpoint and local storage behavior. Treat the matrix installer as privileged software installation and review downloads before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares no permissions while static analysis detected capabilities for environment access, file read/write, and network use. That mismatch prevents informed consent and makes it easier for the skill to perform sensitive local or remote actions without clear user awareness, especially given the surrounding claims about web interaction, installation flows, and linked portals.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This is a serious description-behavior mismatch: the skill presents itself as a tax/audit assistant, but the detected behavior includes host fingerprinting, local MCP config modification, proxying to remote MCP endpoints, API key registration/persistence, web search fallback, and installation/routing of other skills. Those hidden operational capabilities materially expand the attack surface and could enable unauthorized configuration tampering, data exfiltration, remote command mediation, or stealthy expansion beyond the user's expected scope.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The module hard-codes an external MCP service URL and contains bootstrap logic to connect the host client to that remote service or to a local proxy that forwards to it. That behavior is unrelated to a tax-audit assistant’s declared purpose and effectively turns the skill into an installer/integration shim, expanding trust boundaries and enabling remote control or data exposure through an undeclared external endpoint.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code fingerprints the host environment by inspecting environment variables and local configuration directories, then conditionally writes into user MCP/IDE configuration files. This is dangerous because it silently persists the skill into multiple clients, alters user tooling outside the skill’s scope, and can establish durable access paths to the remote service without meaningful user consent.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The client is described as an SOE tax-audit assistant, but this code exposes broad remote tax-policy querying and a public web-search fallback that can send user prompts to external services outside the narrow audit workflow. In an audit context, questions and scenarios may contain sensitive enterprise, tax, or investigation details, so scope expansion materially increases data-exposure risk and makes behavior less predictable than the manifest suggests.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The client automatically registers with a remote service, generates a persistent device identifier, and stores credentials/config locally without any evident user approval. For an internal audit assistant, silent enrollment and persistent identity increase tracking and data-governance risk, especially where usage may relate to sensitive state-owned enterprise investigations.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The logging function writes action data directly to local JSONL logs, and callers include raw tax questions and risk scenarios. Those inputs can contain confidential audit facts, taxpayer details, allegations, and compliance suspicions; storing them in plaintext local logs creates a durable secondary exposure channel even if the remote service is secure.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The server advertises itself as a 国企经责审计涉税风险与合规专项助手, but the code routes all MCP traffic to a generic public tax-policy endpoint. This is a trust-boundary mismatch: users or host agents may provide sensitive audit, tax, expenditure, supplier, or state-owned enterprise compliance data under the assumption it is handled by the declared skill, while it is actually exfiltrated to an unrelated remote service.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: On startup, the code imports and invokes detect_and_setup(), and the comment explicitly states it may write local configuration when TAX_ENABLE_AUTOSETUP=1. That behavior exceeds the declared audit-assistant function and creates an unnecessary capability to inspect the local agent environment and potentially alter client setup, which can weaken user control and expand persistence or lateral configuration impact.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The file is an installer that can automatically install a matrix of additional skills, which exceeds the stated purpose of a tax audit/compliance assistant. This materially expands the skill's capabilities and trust boundary, creating a supply-chain and unexpected-code-execution risk if users trigger it without understanding that it will fetch and install other packages.

Context-Inappropriate Capability

Medium

Confidence: 80% confidence
Finding: The code inspects local ClawHub configuration paths and CLI presence to detect distribution channel. While not directly exfiltrating data, this performs local environment reconnaissance unrelated to the declared audit function and can be used to adapt follow-on download/install behavior based on host state.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The installer downloads ZIP packages from remote URLs and later extracts them into the user's skills directory, effectively extending the local codebase from network-supplied content. Even with basic zip-slip checks, this is a high-risk supply-chain behavior because compromised manifests, URLs, or hosting endpoints could deliver malicious skills.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The page tells users that data is only stored locally and not uploaded, but the workflow later sends self-check metrics to a remote API for evaluation. In a tax/audit compliance tool, this is dangerous because users may disclose sensitive operational risk indicators under false privacy expectations, creating a trust and data-governance failure.

Intent-Code Divergence

Low

Confidence: 82% confidence
Finding: The footer promises that the service does not retain submitted data, but the client code cannot enforce or verify server-side retention practices and also persists API credentials in localStorage indefinitely. This creates misleading privacy assurances and leaves bearer credentials exposed to any script running in the origin if the site is ever compromised.

Vague Triggers

Medium

Confidence: 77% confidence
Finding: A broad activation instruction can cause the skill to trigger on loosely related user requests, which is risky when the skill also appears to expose links, remote web workflows, and possible installation or routing behavior. Overbroad invocation increases the chance of unintentional execution and can be abused to socially engineer users into following external workflows or granting trust outside the intended audit context.

Vague Triggers

Low

Confidence: 72% confidence
Finding: The installation trigger phrase overlaps with normal conversation and lacks clear scope limits, so users may invoke installation behavior unintentionally. In a skill already associated with matrix installation and cross-topic expansion, this increases the risk of privilege creep and unexpected acquisition of additional capabilities.

Vague Triggers

Low

Confidence: 74% confidence
Finding: Presenting a generic installation command as a normal invocation without exclusions encourages accidental execution of package-install or cross-skill behaviors. Because the skill context references automatic downloading and installation of additional skills, vague invocations can be leveraged for unexpected capability expansion beyond the user's initial request.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code automatically writes API keys and configuration to disk during normal operation without user-facing notice. Silent persistence of credentials can violate least surprise and may expose service access if the host is shared, backed up broadly, or inspected by other local users/processes.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: This code path logs and handles question/scenario data in a way that supports transmission to remote services, but there is no user-facing disclosure in this file that entered content leaves the local environment. In this skill's audit setting, users may reasonably input sensitive enterprise and tax-investigation details, so undisclosed transmission creates a meaningful privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The tools/call path forwards arbitrary tool arguments to a remote cloud service via _rpc() without any in-band warning, consent flow, redaction, or local policy gate. In the context of SOE tax-audit work, those arguments may contain highly sensitive financial, personnel, procurement, reimbursement, or investigative data, so silent transmission materially increases confidentiality and compliance risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script performs remote downloads and writes extracted files into the target skills directory, yet the file does not present an explicit, runtime user warning or confirmation before making these changes. In the context of an assistant skill, this increases the chance of silent or surprising installation behavior and reduces meaningful user consent for a privileged filesystem/network operation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code auto-registers a client and stores a bearer API key and client identifier before meaningful prior disclosure of this credentialing behavior. Even if consent is later requested for metric submission, the background registration flow plus persistent token storage expands the tracking and attack surface for a tool handling sensitive audit-risk data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.