Back to skill
Skillv1.0.0
VirusTotal security
XPR Crypto Tax · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
BenignApr 30, 2026, 3:55 AM
- Hash
- 3a6586cfb9ce020a815210c43e04d50418c956bc0482735637a2f533b0ce03f3
- Source
- palm
- Verdict
- benign
- Code Insight
- Type: OpenClaw Skill Name: xpr-tax Version: 1.0.0 The OpenClaw skill 'xpr-tax' is classified as benign. Its primary function is crypto tax reporting, which it performs by querying legitimate public APIs (Saltant, Metal X, CoinGecko) for account balances, DEX trades, and on-chain transfers. It processes this data to calculate gains/losses and generate a tax report in Markdown and CSV formats. The skill accesses `process.env.COINGECKO_API_KEY` for API authentication, which is a standard and expected practice. Crucially, the `dist/index.js` file (the executable code) does not contain any file system operations (e.g., for persistent caching), unlike the provided `src/index.ts`. The `SKILL.md` instructions are clear, align with the stated purpose, and do not exhibit any prompt injection attempts or instructions for unauthorized actions. There is no evidence of data exfiltration to unauthorized endpoints, persistence mechanisms, or malicious obfuscation.
- External report
- View on VirusTotal