增值税法及实施条例落地合规指引

• Outcome: Review
• Latest audit: Jul 28, 2026 · 6:06 AM UTC
• Version: 3.15.3

Overview

This VAT compliance skill includes broad remote-service, credential, installer, and client-configuration behavior that goes beyond a simple tax guidance helper.

Install only if you are comfortable with tax queries and risk scenarios being sent to the operator's remote service, local API credentials and logs being created, and optional setup/installer flows changing local skill or MCP client configuration. Avoid submitting confidential taxpayer, invoice, or business details unless you have reviewed the service and disabled unwanted auto-setup or matrix-install behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (65)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises interactive web workflows, installation of related skills, and behavior that implies local configuration changes and remote service use, yet it declares no permissions. This creates a dangerous transparency gap: users and hosting agents may not realize the skill can access environment data, read/write local files, or use the network, which increases the risk of silent config modification, data exposure, or unexpected remote calls.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is a narrow VAT-compliance assistant, but the described behavior extends into agent detection, local MCP configuration writes, remote service registration/API key retrieval, local logging/cache management, web-search fallback, and installation/routing across other skills. That mismatch is highly dangerous because it can socially engineer users into approving a tax helper while actually granting a general-purpose installer/proxy broad access to their local environment and external services.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The initializer performs host-agent discovery and can modify third-party client MCP configuration files, behavior that is unrelated to a VAT-law compliance assistant’s declared purpose. This creates an unnecessary trust-boundary violation: installing or loading the skill can change how the user’s local AI tooling connects to services, including registering a remote endpoint, which is dangerous even if framed as convenience automation.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code inspects environment variables, home-directory paths, and editor/client configuration directories to infer the host agent type. For a tax-law assistant, this collection of host-environment intelligence is not functionally necessary and increases the attack surface by enabling environment-aware behavior and selective targeting of user systems.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The module can write or merge MCP server settings into Claude Desktop, Cursor, and Cline/VS Code configuration files, thereby altering the user’s local client behavior and trust relationships. That is a persistence-like capability unrelated to tax guidance and could be abused to silently register a remote service endpoint or local proxy process that the user did not intentionally install.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The comments state the module is not responsible for networking, yet the code chooses a cloud HTTP transport and injects a remote service URL into generated client configuration. This mismatch is dangerous because it can mislead reviewers and users about the module’s effective behavior, obscuring that it is steering clients toward a remote service.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill automatically registers with an external service, creates a persistent device identifier, stores credentials locally, and does so without an explicit consent or disclosure step. In a compliance assistant context, this creates unnecessary data egress and persistent tracking risk, especially because tax-related usage may contain sensitive business information.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The fallback path sends user queries to public search engines, which is an external data disclosure channel unrelated to the narrowly described structured VAT compliance workflow. Because questions and scenarios may include sensitive tax or business context, this can leak confidential operational details to third parties without clear user awareness.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill is presented as a VAT-law compliance assistant, but the implementation actually acts as a generic proxy to a broader remote tax-policy MCP service. This mismatch undermines informed consent and trust boundaries: users and hosting agents may provide sensitive tax/compliance inputs believing processing is local and scope-limited, while data is actually sent to a public cloud endpoint with a wider capability surface.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The code forwards user requests over the network to a public cloud MCP endpoint, but that remote dependency is not clearly disclosed by the skill description. In a tax/compliance context, users may submit invoices, transaction facts, or taxpayer details, so silent exfiltration to a third-party service creates privacy, compliance, and supply-chain risk.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The server performs automatic agent detection/setup during startup, which is outside the stated VAT-law assistant purpose and can modify the local agent environment when enabled by environment variable. Hidden environment probing and optional write-side setup increase the attack surface and violate least surprise, especially because this occurs before handling normal tool requests.

Intent-Code Divergence

Low

• Confidence: 79% confidence
• Finding: The docstring states that the server exposes a cloud-aligned safe tool surface, but startup behavior includes additional client detection/setup not represented in that declared interface. This discrepancy is dangerous because it hides side effects from reviewers and users, making security review and operational trust harder in an agent-executed context.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file is explicitly an installer for a broader 'tax skill matrix' and not just the stated VAT-law assistant. It can trigger installation of additional skills based on a manifest, which expands code and content on the host beyond the user’s likely expectation and the declared skill scope. In a skill ecosystem, this creates a supply-chain and permission-boundary issue because one skill becomes a bootstrapper for many others.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code downloads zip packages from URLs in the manifest and installs them into the user skill directory, enabling remote code/content delivery unrelated to the narrow VAT-law compliance purpose. Although it includes a basic zip-slip check, it does not verify package authenticity or integrity via signatures/pinned hashes, so a compromised manifest, channel, or hosting endpoint could deliver malicious packages for persistence and further compromise.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The page explicitly tells users their data is 'local only' and 'not uploaded', but the script sends self-check metrics to a remote API and auto-registers a client credential before use. Even if the transmitted fields exclude some identity inputs, this is still a privacy-deceptive data flow that can mislead users into disclosing sensitive tax/compliance information under false assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The page silently performs client registration and stores a persistent API key in localStorage, which exceeds the expected behavior of a simple tax self-check UI. Persistent browser-stored credentials are accessible to any script running in the origin, increase account/linkability risk, and create an undisclosed trust relationship with the remote service.

Intent-Code Divergence

Low

• Confidence: 80% confidence
• Finding: The comment says identity fields are never carried, but the deep-analysis prompt builder reads the company name and prepares it for copying into an external Agent workflow. This inconsistency can cause users to unknowingly transfer identifying tax/compliance context to another system, especially because the UI frames the process as privacy-conscious.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger list includes broad phrases such as requests to install a full tax skill matrix or related tax skills, which can collide with ordinary user requests and activate the skill outside its narrow VAT remit. In context, this is more dangerous because the skill also advertises cross-skill installation and routing, so broad triggers can become a pathway for unexpected installation or redirection behavior.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The instruction to activate on 'related intent' is too vague and leaves broad discretion for invocation without clear scope boundaries. Given the surrounding content encouraging proactive link surfacing and cross-topic guidance, this can cause unprompted activation, unexpected external navigation, or escalation into broader installation flows than the user intended.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The client defines automatic persistent storage for config, cache, health state, and logs under the user's home directory without any visible notice in the flow. In a tax/compliance tool, such local writes may retain identifiers, questions, scenarios, and operational metadata that users may reasonably expect not to be stored silently.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Automatic registration transmits identifiers to a remote service without user-facing warning or approval, which is especially sensitive for a legal/tax assistant handling potentially confidential business matters. Even if the identifiers are described as anonymous, the combination of persistent device ID and subsequent usage can support tracking and undisclosed data processing.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: User questions and risk scenarios are transmitted to an external MCP service, yet the code does not provide a user-facing disclosure at the call sites or enforce minimization of sensitive content. In a tax-risk and compliance context, these prompts may contain commercially sensitive facts, invoice details, or audit concerns, making undisclosed outbound transmission materially risky.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: User-provided tool arguments are transmitted directly to a public cloud endpoint without explicit runtime notice or consent. Because this is a tax-policy assistant, those arguments may contain sensitive business, invoice, or taxpayer information, making undisclosed transmission a meaningful confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Automatic registration and local storage of an API key occurs without an adjacent warning that a persistent credential will be created and retained in the browser. Users of a tax-compliance page would not reasonably expect credential provisioning as a side effect, which undermines informed consent and increases risk if the origin is later exposed to XSS or shared-browser access.

External Transmission

Medium

• Category: Data Exfiltration

Content

"slug": "tax-advisory-practice",
      "name": "财税中介机构AI合规咨询服务转型专题",
      "package": "tax-advisory-practice.zip",
      "download_url": "https://api.skillhub.cn/api/v1/download?slug=tax-advisory-practice",
      "is_core": false,
      "board": "B",
      "version": "3.15.3",

• Confidence: 95% confidence
• Finding: https://api.skillhub.cn/

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.