CRS Tax Calculator
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The tax tool matches its stated purpose, but it uploads sensitive financial statements to a third-party service and has unsafe API-key and output-file handling that should be reviewed before use.
Before installing, confirm you trust the provider with your brokerage statements and tax data. Avoid echoing the API key, and prefer a patched version that sanitizes output filenames before writing Excel files locally.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Your CRS API key could be displayed and retained somewhere you did not intend.
The skill instructs users or the agent to print the API key value while checking setup. That can unnecessarily expose a credential in logs or conversation output.
echo "CRS_API_KEY=${CRS_API_KEY:-(未设置)}" ... 设置完成后验证：`echo $CRS_API_KEY`Check only whether the variable is set, not its value; for example, use a presence check that prints 'set' or 'missing' without revealing the key.
A malicious or compromised API response could overwrite files the user account can write to.
The script trusts a filename returned by the remote API and joins it directly to the output directory. Absolute paths or ../ path traversal in that filename could cause writes outside the intended folder.
fname = yr['excel']['filename'] out_path = os.path.join(out_dir, fname) with open(out_path, 'wb') as f:
Sanitize remote filenames with os.path.basename, reject absolute paths and '..' components, and ensure the resolved path stays inside the chosen output directory before writing.
Brokerage statements and tax-related financial data leave the local machine for processing by the provider.
The helper base64-encodes the selected statement files and sends them with the provider API key to the stated external API.
API_URL = 'https://api.wealthlplantation.com/api/process' ... 'data': data ... 'Authorization': f'Bearer {api_key}'Use this only if you trust wealthlplantation.com with the selected files, and avoid passing unrelated or overly broad file paths.