Back to skill
Skillv0.2.0
ClawScan security
tax-filing · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 4, 2026, 7:46 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and included files are coherent with a US federal tax-preparation assistant that fills and validates PDF forms; it requests no external credentials or installs and contains no obvious exfiltration or unrelated capabilities.
- Guidance
- This skill appears internally consistent: it contains helpful reference docs and a small pypdf helper to update IRS PDF fields. Before installing or running it, verify you trust the skill source and run it locally (do not upload sensitive tax docs to unknown services). Review scripts/update_form.py yourself (it is short and does no networking). Ensure pypdf is installed in a safe environment and avoid running code from unknown authors with your real SSN/financial documents; consider consulting a tax professional for complex or high‑risk filings.
Review Dimensions
- Purpose & Capability
- okName/description (US federal tax filing + PDF form filling) match the included references and the bundled pypdf-based update_form.py script; the files and guidance are proportional to preparing and validating 1040/1040‑NR workflows.
- Instruction Scope
- okSKILL.md restricts actions to gathering user-provided tax documents, routing forms, calculating amounts, and filling/validating PDFs. It does not instruct reading unrelated system files or contacting external endpoints. The directive to activate on any tax-related user prompt is broad but consistent with the skill's purpose.
- Install Mechanism
- okThis is an instruction-only skill with no install spec. The only runtime dependency is pypdf (checked in scripts/update_form.py). No downloads, URLs, or archive extraction are present.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. The workflow legitimately needs access to user tax documents (W‑2, 1099s, etc.), which is appropriate for the stated purpose.
- Persistence & Privilege
- okalways:false and default invocation settings are used. The skill does not request permanent system presence or modify other skills' configurations.