ClawHub
Back to skill

Security audit

企业财税合规审计与税务审计指引

Security checks across malware telemetry and agentic risk

Overview

This tax-audit skill is purpose-related, but it needs Review because it can send tax data to cloud services, store service keys, modify agent configuration, and install additional skills.

Install only if you trust the mcp.aitaxs.top, api.skillhub.cn, and clawhub.ai service paths with tax/audit content. Avoid sending client-identifying or confidential tax facts unless cloud processing is approved. Do not use the full matrix installer or enable TAX_ENABLE_AUTOSETUP unless you intentionally want additional skills installed and MCP configuration persisted in your local agent clients.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (60)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares no permissions, yet the analyzed behavior indicates access to environment variables, local files, file writes, and outbound networking. That mismatch prevents informed consent and means a user could install what appears to be a documentation-style audit assistant while actually granting a much broader execution surface, including configuration tampering and data exfiltration paths.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
This is a strong description-behavior mismatch: the skill presents itself as a tax/audit guidance tool but reportedly detects host environment details, edits MCP client configs, proxies traffic to a remote endpoint, registers API keys externally, performs web searches, and installs other packages. A mismatch this large is dangerous because it can conceal supply-chain style behavior, persistence/config changes, and unexpected outbound data flows under the cover of a benign business assistant.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The file implements agent fingerprinting, transport selection, and MCP bootstrap/configuration rather than any tax audit or compliance functionality described in the skill metadata. This mismatch is dangerous because it hides host-integration and persistence behavior behind a benign business-facing description, increasing the likelihood that users or reviewers will trust code that alters local tool behavior and connects to an external service.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code can modify local Claude, Cursor, and VS Code/Cline configuration files to register an MCP server, which is unrelated to the stated tax-audit use case. Even if framed as convenience setup, writing into user config creates persistence and can silently route future agent interactions through a remote or local proxy service, expanding attack surface and enabling unauthorized data exposure or control.

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
The comments claim that no new network endpoint is introduced, but the code hardcodes a remote SERVICE_URL and can configure clients to use it over HTTP. This discrepancy is risky because it misleads reviewers and users about network behavior, weakening informed consent and potentially causing sensitive prompts, documents, or tool traffic to be sent to an external service unexpectedly.

Intent-Code Divergence

Medium
Confidence
86% confidence
Finding
The module executes initialization logic at import time via _maybe_init_agent(), despite documentation claiming import-time behavior is limited and 'default not write to disk.' Import-time side effects are dangerous because merely loading the module can trigger external detection logic and potentially logging or filesystem changes in another module, violating least surprise and making review and containment harder.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This file implements an MCP stdio proxy for a remote tax-policy knowledge service instead of the declared tax-audit assistant, creating a significant skill-identity mismatch. Users and host agents may send sensitive audit, finance, or tax-compliance data to an unexpected third-party endpoint, which is dangerous because the behavior is not aligned with the manifest and can bypass trust decisions based on the advertised skill purpose.

Intent-Code Divergence

Medium
Confidence
86% confidence
Finding
The docstring asserts exposure of a specific 'safe tool surface' for a cloud endpoint even though the package metadata describes a broader enterprise tax-audit/compliance assistant. This inconsistency can mislead reviewers and users about the skill’s actual behavior, reducing informed consent and increasing the chance that sensitive business data is disclosed to tooling the user did not intend to invoke.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The script is an installer that can fetch and install additional skills, which materially exceeds the declared purpose of a tax-audit advisory skill. In this context, hidden expansion of capabilities increases supply-chain and privilege risk because a user invoking a finance/compliance assistant would not reasonably expect software installation and network retrieval behavior.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The code probes local ClawHub configuration files and CLI presence to infer an installation channel, which is unrelated to tax-audit functionality and expands host introspection. While not directly exfiltrating data, this environment discovery is an unnecessary capability that can be repurposed to profile the user's system and silently alter remote download behavior.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The script downloads ZIP packages from URLs in the manifest and then installs them, creating a direct supply-chain risk. Even with basic zip-slip checks, there is no cryptographic verification, allowlisted origin enforcement, or strong trust validation of downloaded content, so a compromised manifest, URL, or hosting endpoint could lead to installation of malicious skills.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
Writing into ~/.skills and extracting packages modifies the user's local skill environment, which is a persistent state-changing action outside the expected scope of a tax-audit assistant. If abused, this can plant untrusted skills for later execution and broaden compromise beyond the current interaction.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The page explicitly tells users the workflow is local-only and does not upload data, yet `runIndicatorCheck()` posts collected audit metrics to a remote service and `_ensureApiKey()` silently registers the browser with that service. Even if identity fields are excluded from the POST body, the transmitted metrics are still sensitive business compliance data, and the mismatch between disclosure and behavior creates a privacy and trust violation with real data-exfiltration risk.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The code comments and UI language emphasize that identity fields are excluded from transmission, but later `buildDeepPrompt()` and `generateReport()` reuse company-identifying data in generated prompts and clipboard-ready reports. This can cause users to paste sensitive enterprise identity and compliance findings into external AI chats or documents under a misleading assumption that identity never leaves the local workflow.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The functions tax_policy_ask and risk_check send user-supplied tax questions and scenarios to a remote public endpoint, and these inputs can contain sensitive financial, tax, audit, or compliance information. In the context of an enterprise tax-audit assistant, silent transmission of such data to an external service materially increases confidentiality, regulatory, and client-data exposure risk.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The local fallback search sends user queries to Bing/Baidu without clear disclosure at the point of execution. Because the skill handles tax, audit, and compliance scenarios, fallback queries may reveal sensitive business facts, suspected fraud indicators, or client-specific tax matters to third-party search providers outside the expected trust boundary.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The _rpc function forwards tool-call arguments over HTTP(S) to a remote service without any user-facing notice or consent flow in this file. In this skill context, arguments may contain confidential tax, audit, invoice, related-party, or fraud-investigation details, so silent transmission to an external endpoint creates a meaningful confidentiality and compliance risk.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script is designed to perform automatic downloads of additional skill packages without an interactive confirmation at the moment of action. In a skill ecosystem, that weakens user awareness and consent, making socially engineered or unexpected software changes more likely.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The browser automatically performs client registration and persists an API key plus client ID in `localStorage` without an explicit warning at the moment this occurs. Silent credential issuance and long-lived storage increase the chance of unnoticed tracking, misuse by other scripts running in the origin, and user confusion about remote account creation.

External Transmission

Medium
Category
Data Exfiltration
Content
"slug": "tax-advisory-practice",
      "name": "财税中介机构AI合规咨询服务转型专题",
      "package": "tax-advisory-practice.zip",
      "download_url": "https://api.skillhub.cn/api/v1/download?slug=tax-advisory-practice",
      "is_core": false,
      "board": "B",
      "version": "3.15.3",
Confidence
95% confidence
Finding
https://api.skillhub.cn/

External Transmission

Medium
Category
Data Exfiltration
Content
"slug": "tax-capital-reduction",
      "name": "减资撤资（未实缴减资）个人所得税财税合规专题",
      "package": "tax-capital-reduction.zip",
      "download_url": "https://api.skillhub.cn/api/v1/download?slug=tax-capital-reduction",
      "is_core": false,
      "topics": [
        "减资",
Confidence
95% confidence
Finding
https://api.skillhub.cn/

External Transmission

Medium
Category
Data Exfiltration
Content
"slug": "tax-compliance-dispute",
      "name": "合规争议财税专题",
      "package": "tax-compliance-dispute.zip",
      "download_url": "https://api.skillhub.cn/api/v1/download?slug=tax-compliance-dispute",
      "is_core": false,
      "topics": [
        "财税内审",
Confidence
95% confidence
Finding
https://api.skillhub.cn/

External Transmission

Medium
Category
Data Exfiltration
Content
"name": "建筑施工行业财税合规专题",
      "slug": "tax-construction",
      "package": "tax-construction.zip",
      "download_url": "https://api.skillhub.cn/api/v1/download?slug=tax-construction",
      "is_core": true,
      "topics": [
        "建筑施工",
Confidence
95% confidence
Finding
https://api.skillhub.cn/

External Transmission

Medium
Category
Data Exfiltration
Content
],
      "version": "3.15.3",
      "download_urls": {
        "skillhub": "https://api.skillhub.cn/api/v1/download?slug=tax-contract-generation-review",
        "clawhub": "https://clawhub.ai/api/v1/download?slug=tax-contract-generation-review"
      },
      "board": "Shared",
Confidence
96% confidence
Finding
https://api.skillhub.cn/

External Transmission

Medium
Category
Data Exfiltration
Content
"slug": "tax-crossborder",
      "name": "跨境电商与贸易财税合规专题",
      "package": "tax-crossborder.zip",
      "download_url": "https://api.skillhub.cn/api/v1/download?slug=tax-crossborder",
      "is_core": false,
      "topics": [
        "跨境电商",
Confidence
95% confidence
Finding
https://api.skillhub.cn/

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.