Security audit

tax-transfer-pricing

Security checks across malware telemetry and agentic risk

Overview

The skill is a transfer-pricing assistant, but it includes broader cloud tax-policy integration, optional MCP client configuration writes, local identifiers, and logging that users should review before installing.

Install only if you are comfortable with a cloud-backed tax-policy service, local persistent identifiers/API keys, local logs of tax questions, and optional MCP configuration changes. Avoid entering confidential taxpayer IDs, financial statements, trade secrets, or sensitive company details unless you have reviewed the provider's privacy and retention practices.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill declares no permissions, yet the content and linked workflow imply capabilities such as network access and possible local configuration or file manipulation. This creates a transparency and consent problem: users and hosts cannot accurately assess what the skill may access or modify, increasing the risk of overprivileged behavior or hidden side effects.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared scope is a narrow transfer-pricing compliance assistant, but the analyzed behavior indicates much broader actions, including client environment detection, MCP config modification, remote registration, caching/logging, broad tax functions, and web-search fallback. This mismatch is dangerous because it undermines informed consent and can mask sensitive operations that users would not expect from a topic-specific compliance skill.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The initialization logic is designed to detect host agent environments and potentially persist MCP registration into client configuration files, behavior that is unrelated to a transfer-pricing compliance assistant. This creates an installation/persistence mechanism inside a content skill, expanding execution and network reach beyond the user’s expected tax-assistance scope.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code inspects environment variables, user home directories, and extension folders to infer what host tools are installed. Even without exfiltration shown here, this is unnecessary local environment reconnaissance for a tax assistant and can be used to profile the system and select persistence or execution paths.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code writes or merges entries into Claude Desktop, Cursor, and Cline configuration files to register an MCP service, giving the skill a path to persist itself into client tooling. For a transfer-pricing assistant this is unjustified, and if enabled it can silently alter user agent behavior and route future requests to a remote service.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The embedded service URL, slug, and display name point to a different service identity than the manifested transfer-pricing skill. This mismatch strongly suggests the package may be masquerading as one skill while connecting users to another backend, undermining trust, reviewability, and least surprise.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file is a generic stdio-to-cloud proxy for a broad tax-policy MCP service, while the declared skill is specifically for transfer-pricing compliance. This creates a capability/intent mismatch that can expose users or agents to a wider tool surface than expected, increasing the risk of unauthorized data disclosure, policy bypass, or misuse of the skill in contexts outside its stated scope.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The module docstring explicitly advertises a cloud 'tax-policy' tool surface that is broader than the transfer-pricing assistant described in the skill metadata. This inconsistency is dangerous because agents and reviewers may trust the metadata while the code silently routes requests to a different remote capability set, undermining least-privilege and informed consent.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The workflow content materially exceeds the skill’s declared transfer-pricing scope and introduces a generic tax-compliance process that users could rely on for unrelated tax matters. In a compliance assistant, scope drift is dangerous because it can cause users to receive incomplete or inapplicable guidance while believing it is authoritative for broader tax issues.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The offline risk engine classifies scenarios using broad tax-fraud and general compliance keywords, including matters unrelated to transfer pricing, which can mislead users about the tool’s competence and coverage. Such misalignment is risky in a tax context because false reassurance or misclassification may affect legal compliance decisions and incident escalation.

Intent-Code Divergence

Low

Confidence: 80% confidence
Finding: The documentation claims the module only provides standardized process guidance, but the implementation performs substantive risk classification and recommends actions based on detected keywords. This mismatch can create unwarranted trust in the tool’s outputs and obscure that it is making assessment decisions rather than merely routing users through a checklist.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The UI states that data is kept locally and not uploaded, but the self-check flow sends entered metric data to a remote API after consent. Even if identity fields are excluded, this is still a trust-boundary and transparency issue because users are told one thing in the main workflow and the code does another. In a tax-compliance skill, the metrics themselves can be commercially sensitive and may reveal internal related-party risk posture.

Context-Inappropriate Capability

High

Confidence: 91% confidence
Finding: The page includes unrelated code paths for R&D timesheets, project initiation letters, and auxiliary ledger export inside a transfer-pricing skill. This kind of cross-topic code reuse expands attack surface, increases the chance of latent data handling bugs, and suggests accidental inclusion of functions that may process or export sensitive data in ways users do not expect. In a tax workflow handling enterprise information, unnecessary features materially raise risk.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The code comments assert that q_* identity fields are never carried, but the deep analysis prompt builder reads q_company and inserts the company name into a generated prompt intended for copying into an Agent conversation. That creates a privacy leak path outside the stated non-identity-data boundary, especially because users may assume downstream sharing is anonymized. In this context, a company name combined with transfer-pricing issues can expose highly sensitive tax/compliance posture.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill actively directs users to an external web page and encourages copying page-generated prompts back into chat, but it does not clearly instruct users to avoid entering confidential enterprise, tax, or personal data. In a tax and transfer-pricing context, this is especially sensitive because users may input related-party transaction details, financials, ownership structure, or audit-response materials that could expose regulated or commercially sensitive information.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The client logs raw user questions, tax scenarios, and error details to local JSONL files. In a tax/compliance assistant, these inputs can contain sensitive financial, legal, or business-relationship data, creating avoidable local data exposure to other users, support personnel, backups, or malware reading the home directory.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The client silently auto-registers with a remote service and persists a device identifier that is then transmitted during registration. Even if pseudonymous, a stable identifier enables cross-session correlation of user activity and can create privacy and compliance issues when combined with tax-related queries and logs.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.