Equity
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill is advertised as an equity modeling calculator, but the provided script appears to be a generic local logger rather than a cap-table or dilution modeling tool.
Review this skill before installing. It does not show evidence of exfiltration or destructive behavior, but it also does not appear to implement the advertised equity calculations. If you use it, verify the executable being run and avoid entering confidential cap-table or compensation data unless you are comfortable with it being stored in local plaintext logs.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user could rely on this skill for startup equity decisions even though the provided code does not show the promised modeling behavior.
The script presents a generic utility/logger workflow that saves user input, while the skill description promises cap-table, dilution, vesting, and option-pricing modeling. This mismatch could cause users to trust a tool that does not appear to perform the advertised financial calculations.
echo "Equity v2.0.0 — utility toolkit" ... echo "$ts|$input" >> "$DATA_DIR/run.log" ... echo " [Equity] run: $input"
Do not rely on this skill for cap-table or financing calculations unless the author provides reviewed code that implements the advertised equity formulas and outputs.
Confidential equity or compensation details entered into the tool may remain in local log files and exports.
The skill intentionally stores and searches local history. That is purpose-aligned for tracking equity data, but cap tables, ownership percentages, option grants, and investor terms may be sensitive.
Local data storage with JSON/CSV export - History tracking and activity logs - Search across all entries
Use only on a trusted machine, avoid entering unnecessary confidential details, and review or delete the local data directory when finished.
The agent may fail to run the intended tool, or could invoke some other `equity` command already present on the system if one exists.
SKILL.md documents an `equity` command and the package includes `scripts/script.sh`, but the install metadata does not declare how that command is installed or required. This is an operational/provenance gap rather than evidence of malicious behavior.
No install spec — this is an instruction-only skill.
Verify exactly what executable will run before using the skill, and prefer a package that declares its install mechanism and required binaries.