Calctool

ReviewAudited by ClawScan on May 10, 2026.

Overview

CalcTool is advertised as a calculator, but the provided artifacts show it mainly logs user-entered calculation text to local files.

Install only if you want a local logbook for calculation-related entries, not a full calculator. Do not enter sensitive financial details unless you are comfortable with them being saved under ~/.local/share/calctool, and verify how the included script is actually installed or invoked.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A user may expect math or financial calculations to be performed, while the tool may only save the entered text locally.

Why it was flagged

The advertised purpose says the skill performs calculations, but the documented command behavior is logging entries. That mismatch could cause a user or agent to trust it as a calculator when it is primarily a local logbook.

Skill content
description: "Perform basic, scientific, and financial calculations from the terminal" ... "calctool run <input> | Log a run entry" ... "Each command logs input with timestamps"
Recommendation

Clarify the description as a calculation logbook, or add real calculation functionality and clearly separate calculating from logging.

What this means

Information entered into the tool can remain on the local machine and later appear in recent, search, stats, or export outputs.

Why it was flagged

The script stores user-supplied command input in persistent local log files, which may include financial calculations, analysis notes, or other sensitive text.

Skill content
DATA_DIR="${HOME}/.local/share/calctool" ... echo "$ts|$input" >> "$DATA_DIR/run.log"
Recommendation

Avoid entering secrets or highly sensitive financial details unless local logging is intended; provide a clear delete/retention option for stored logs.

What this means

The command may fail, rely on an existing local calctool command, or be installed differently than expected.

Why it was flagged

The artifact set includes a runnable script, but the metadata does not define how it is installed or invoked, and required binaries are not declared despite SKILL.md listing Bash/POSIX utilities.

Skill content
No install spec — this is an instruction-only skill ... Code file presence: scripts/script.sh
Recommendation

Declare the Bash/POSIX runtime requirements and provide an explicit install or invocation path for the included script.