Ask a Tax Nerd

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:21 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent tax-help skill, but it can present stale 2024 tax numbers as current guidance in a high-stakes domain.

Review carefully before installing. Use it only for educational US tax explanations, verify any numbers, limits, and deadlines against current IRS and state sources, and avoid relying on it for filing positions or calculations outside tax year 2024 without professional review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:56

Finding

Unpinned Remote Installer and Mutable Skill Source

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 56–66
Vulnerability Type: Supply-chain risk caused by unpinned remote dependencies
Risk Level: Medium

Vulnerable Code

markdown

## Install

```bash
npx clawhub@latest install howie-ge/tax-plain-english

Or clone and drop the folder into your skills directory:

bash

git clone https://github.com/howie-ge/tax-plain-english
cp -r tax-plain-english ~/.openclaw/skills/

text

### Technical Analysis

Both documented installation methods rely on mutable remote resources.

The `npx clawhub@latest` command downloads and executes whichever package version is tagged as `latest` at installation time. The documentation does not pin an audited version, require an integrity hash, or provide a signature-verification procedure. Depending on npm package behavior, installation may also execute package lifecycle code.

The Git alternative clones the repository's default branch without checking out a specific commit or signed release. It then copies the downloaded content directly into the Agent's trusted skill directory. Consequently, the files installed by a user may differ from those reviewed in this audit.

No evidence indicates that the currently audited project contains a malicious dependency or payload. The vulnerability is the absence of controls ensuring that future downloaded content is identical to the audited content.

### Attack Path

1. An attacker compromises the npm publisher account, the `clawhub` package, the skill publisher account, or the referenced Git repository.
2. The attacker publishes a modified package release or changes the repository's default branch.
3. A user follows the documented `npx ...@latest` or unpinned `git clone` installation command.
4. The installation retrieves attacker-controlled content rather than the audited version.
5. In the npm path, malicious package lifecycle behavior may execute with the instal
...[truncated 767 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with a specific, audited package version.
2. Pin the Git installation instructions to an immutable commit hash or signed release tag.
3. Publish SHA-256 checksums for release archives and document how users must verify them before installation.
4. Use package provenance or cryptographic release signatures and verify the publisher identity.
5. Recommend downloading and reviewing package contents before executing an installer.
6. Avoid installation paths that automatically run lifecycle scripts where practical; otherwise, explicitly document that behavior.
7. Add a lockfile or release manifest identifying the exact reviewed versions and content hashes.
8. Establish a release process that audits all changed skill instructions and dependencies before updating the recommended version.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:174

Finding

Fixed 2024 Tax Data Is Presented as Current-Year Guidance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 174–180 and 264; README.md, lines 13 and 47–50; references/2024-numbers.md, lines 1–4
Vulnerability Type: Unsafe high-stakes configuration using stale financial reference data
Risk Level: Medium

Vulnerable Content

SKILL.md, lines 174–180:

markdown

## Jurisdiction handling

**This skill covers US federal tax law only**, current tax year.

**State notes:** After answering the federal question, add a brief state note when state rules commonly diverge. Pattern: *"State rules vary — [specific example of a state that handles this differently] is a notable exception."* Name specific states rather than saying "some states." Prioritize high-population states: CA, TX, NY, FL, WA, IL.

SKILL.md, line 264:

markdown

- **`references/2024-numbers.md`** — Load whenever you need specific rates, limits, thresholds, deadlines, or contribution caps. This is the single source of truth for all current-year numbers. Always cite the tax year when quoting from it.

README.md, line 13:

markdown

- **Answers with current 2024 numbers** — brackets, contribution limits, deadlines, credits — from a built-in reference file, not from hallucination

README.md, lines 47–50:

markdown

- `references/2024-numbers.md` — every rate, bracket, limit, and deadline for 2024
- `references/irs-publications.md` — 40+ topics mapped to official IRS publications and interactive tools
- `references/state-quirks.md` — notable state-level differences (CA capital gains, no-income-tax states, Social Security treatment, remote work traps)
- `references/escalation-guide.md` — calibration for the 🟢/🟡/🔴 flag with specific examples and professional finder links

references/2024-numbers.md, lines 1–4:

markdown

# 2024 Tax Year — Key Numbers

> Source of truth for all rates, limits, and thresholds. Always cite the tax year when quoting these
...[truncated 2221 chars]

Remediation

View remediation

Remediation Suggestions

1. Change the declared scope from “current tax year” to “tax year 2024” unless current data is added and maintained.
2. Require the Agent to ask for the applicable tax year before giving any numerical answer.
3. Refuse calculations for unsupported tax years instead of substituting 2024 values.
4. Store annual values in separately versioned files, such as 2024-numbers.md, 2025-numbers.md, and 2026-numbers.md.
5. Add an explicit mapping from the user's requested year to the corresponding reference file.
6. Validate each annual update against current official IRS publications and state tax-authority sources.
7. Include a reference-data version and last-reviewed date in every numerical response.
8. Add automated consistency tests that fail when the declared current year does not have a corresponding validated reference file.
9. Review time-sensitive third-party thresholds and URLs, including Free File and VITA eligibility values, during every annual release.
10. Preserve the instruction to cite the tax year, but do not treat citation alone as a substitute for selecting the correct year's data.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger criteria are intentionally expansive and include casual mentions of tax-related terms, which can cause the skill to activate when the user did not actually request tax guidance. In a high-stakes domain like tax, unnecessary invocation increases the chance of irrelevant, overconfident, or jurisdiction-mismatched advice being inserted into conversations.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

md

- Do not give specific advice that requires knowing the user's full financial picture (e.g., "you should convert to Roth this year" without caveat)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 93% confidence

Finding

The anti-refusal language pushes the assistant to continue explaining even when situations are complex, which can weaken safety boundaries in a tax skill where incorrect guidance can trigger penalties, missed elections, or harmful filings. In this context, discouraging refusal without clearly preserving the ability to defer on case-specific determinations increases the chance of overconfident, unauthorized professional-style advice.

Content

Scanner excerpt · references/escalation-guide.md (reported line 153)May include surrounding context.

md

## What NOT to Say

- Don't say "I'm not a tax professional and this isn't tax advice" as an opener — it undermines every answer before it's given. Trust is built by being right and being clear, not by disclaiming everything upfront.
- Don't refuse to explain a concept just because the situation is complex — explaining how something works and recommending professional help are not mutually exclusive.
- Don't say "it depends" without immediately saying what it depends on.
- Don't add a generic "consult a professional" to every 🟢 situation — it signals you don't actually mean it when it matters.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The README instructs users to run npx clawhub@latest install ..., which pulls and executes the latest published package version at install time. Because the version is not pinned, a compromised maintainer account, malicious new release, or supply-chain takeover could cause arbitrary code execution on a user's machine during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Defaulting to US federal tax law when jurisdiction is unclear can produce materially wrong guidance for users in other countries, especially because tax rules are highly location-specific. Although the skill appends a clarifying note, it still answers fully first, which may mislead users into acting on incorrect advice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This guidance explicitly discourages upfront disclaimers in a tax-advice skill, including for high-risk scenarios. In a regulated domain like tax, removing clear cautionary framing can cause users to over-trust generalized guidance and act without recognizing when jurisdiction, facts, or filing posture materially change the answer.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.