CPA
PassAudited by ClawScan on May 1, 2026.
Overview
This instruction-only CPA study skill looks benign, but it persists exam-related personal data locally and may ask for calendar access for scheduling.
Safe to consider installing from a security perspective. Before use, decide what CPA records you want saved in ~/cpa/, keep that folder private, verify official CPA eligibility and deadline information with your state board or NASBA, and only allow calendar access if you are comfortable sharing schedule availability with the agent.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
CPA scores, education status, NTS dates, and study history could remain accessible to anyone or any process that can read the local ~/cpa/ directory.
The skill intentionally creates persistent local records containing exam progress, scores, deadlines, and study feedback. This is aligned with the stated tracking purpose, but users should know the data will remain on disk.
User data lives in `~/cpa/` ... profile.md ... practice/ ... nts/ ... passed/ ... feedback.md
Keep the ~/cpa/ folder private, avoid storing unnecessary sensitive documents or identifiers, and delete or archive the folder when no longer needed.
If granted, the agent may see calendar details beyond what is needed to find study availability.
The working-professional workflow implies optional access to a personal or work calendar. This is useful for scheduling study blocks, but calendar contents can be sensitive and no explicit access boundary is defined in the artifact.
- Integration with work calendar ... - Scan calendar for available study blocks
Only allow calendar access when needed, prefer read-only access, and ask the agent to use free/busy availability rather than event details where possible.
A tutor could accidentally mix or expose one candidate's progress, scores, or weaknesses to another person if records are not kept separate.
The tutor workflow contemplates storing and comparing multiple candidates' progress. This is purpose-aligned, but it increases the importance of separating student records and obtaining permission before sharing reports.
- Maintain separate tracking per student - Aggregate insights ... - Generate student progress reports
Use separate folders or clearly labeled files per candidate, confirm sharing permissions, and avoid including personally identifying information in aggregate reports unless necessary.