新疆区域税收优惠与落地经营实操专题（困难地区两免三减半·喀什霍尔果斯五免·西部大开发15%）

• Outcome: Review
• Latest audit: Jul 31, 2026 · 6:23 PM UTC
• Version: 3.15.6

Overview

This tax assistant is mostly coherent, but it under-discloses remote data forwarding, persistent credentials/logs, and optional host configuration changes.

Install only if you are comfortable with a cloud-backed tax assistant that may send tax questions, scenarios, and self-check indicators to mcp.aitaxs.top, persist API credentials locally, and create local logs. Avoid entering sensitive company, personal, or filing-ready tax details unless the publisher's data handling and retention practices are acceptable to you. Do not enable TAX_ENABLE_AUTOSETUP or run config/init_agent.py directly unless you intend it to modify your AI client MCP configuration.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill presents itself as a tax-policy assistant, yet the detected capabilities include environment access, local file read/write, and network use without any declared permissions or transparent justification. In this context, undeclared access is dangerous because it can modify local configuration, exfiltrate data, or install persistence while the user expects only informational tax guidance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a severe description-behavior mismatch: a narrowly scoped Xinjiang tax advisory skill allegedly performs client fingerprinting, local config modification, remote registration, cloud MCP connectivity, and generic search activity unrelated to the declared purpose. Such hidden behavior is highly dangerous because it can silently alter the user's agent environment, establish remote control or data flows, and abuse trust gained from an innocuous business-compliance façade.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This module performs agent detection and can modify third-party MCP client configuration files, behavior that is unrelated to a Xinjiang tax-preferential advisory skill. A domain-specific tax assistant should not persist changes into external AI client configs during initialization, because that creates an unexpected control surface and can silently enroll the user into a remote service endpoint.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code fingerprints the local environment by checking environment variables and well-known directories to determine which AI client is installed. Even if limited, this host reconnaissance is unnecessary for a tax advisory function and increases risk by collecting execution-context information that could be used to tailor persistence or remote integration behavior.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code writes or merges entries into config files under the user's home directory for Claude Desktop, Cursor, and VS Code/Cline, causing durable changes outside the skill's stated purpose. This is dangerous because it can persist remote service access or local proxy execution across sessions without a narrowly scoped business need, and the dry-run guard is bypassed when run as __main__ with dry_run=False.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The client implements a broad local web-search fallback over generic tax topics that materially exceeds the declared Xinjiang preferential-tax scope. In a tax advisory skill, this can cause users to unknowingly receive out-of-scope or inaccurate guidance from public search results, creating integrity and compliance risk, especially when the fallback is presented as part of the same assistant workflow.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The fallback sends queries to external public search engines, but that external data flow is not reflected in the skill’s stated behavior. This is dangerous because user tax questions may be disclosed to third parties without clear expectation, and the assistant may blend untrusted search results into what appears to be a controlled specialist skill.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The hard-coded client identity 'tax-social-insurance' conflicts with the declared Xinjiang tax-policy purpose, indicating identity mismatch during outbound requests. This can undermine auditability, confuse server-side attribution and rate limiting, and suggests the code may have been repurposed without fully aligning trust boundaries or telemetry semantics.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The server advertises itself as a Xinjiang-focused tax assistant, but the implementation is a generic proxy to a remote cloud MCP endpoint exposing broader tax-policy tools. This creates a scope-transparency and data-governance issue: users may send sensitive business/tax data believing it is handled by a narrow local skill, while it is actually forwarded to an external service with capabilities beyond the manifest description.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The code performs client/agent detection and may invoke optional setup logic unrelated to tax advisory functionality. Even if gated by an environment variable, this introduces behavior that can modify the host integration environment and expands the trust boundary beyond simple policy Q&A, which is risky for a skill expected to be narrowly scoped.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Environment detection and optional auto-setup are not necessary for answering tax-policy questions and create unnecessary access to host context. In adversarial or sensitive environments, such behavior can enable reconnaissance about the client runtime or unintended configuration changes, increasing the attack surface of an otherwise simple stdio proxy.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The consent dialog says the page may send example metrics like '研发费用占比、人员比例等', but this skill actually transmits Xinjiang tax self-check indicators such as main business income ratio, substantial operations, first-income evidence, stacking, and branch-rate applicability. Misstating what data leaves the browser undermines informed consent and can cause users to authorize transmission under false assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The page silently registers a client with a remote service and stores the returned API key plus client identifier in localStorage. localStorage is accessible to any script running in the origin, so an XSS issue or third-party script compromise could expose reusable credentials and enable unauthorized API use or tracking beyond the narrow tax self-check purpose.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The UI states the workflow is completed locally and '不上传', yet runIndicatorCheck() sends collected metrics to a remote API endpoint for evaluation. Even if identity fields are excluded, transmitting compliance-related tax metrics off-device contradicts the privacy representation and creates a data-handling risk through deception and unexpected disclosure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code transmits tax questions and risk scenarios to remote services and logs the full question/scenario locally without any visible notice, minimization, or consent flow in this file. Because tax scenarios can contain highly sensitive business and personal financial details, this creates a meaningful privacy and confidentiality risk through both third-party disclosure and local persistence.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: All tool arguments are transmitted over HTTP(S) to a remote service, but this file provides no user-facing warning or consent flow. Because the tools are for tax and risk analysis, inputs may contain highly sensitive financial, corporate, or personally identifiable data, making silent remote forwarding a meaningful confidentiality risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Clicking '立即自检' leads into cloud submission after a modal gate, but the trigger itself is not labeled with a nearby, persistent warning that this action sends metrics to a remote API. In a tax/compliance workflow, users may treat the page as offline/self-check and disclose sensitive operational indicators without clear contextual notice at the point of action.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.