Tax Professional
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: tax-professional Version: 1.0.1 The skill is classified as suspicious due to its use of `clawdbot cron add` commands in `SKILL.md`. These commands instruct the agent to create persistent scheduled tasks that send messages to an external channel (Telegram). While the messages themselves are benign tax reminders and align with the stated purpose of 'proactive year-round tax calendar nudges', the direct execution of system commands, creation of persistence, and use of external communication channels represent high-risk capabilities that could be repurposed for malicious activities if the skill were compromised or designed with ill intent. Additionally, the skill is instructed to read data from other skills' workspaces (`data/mechanic/state.json`, `data/card-optimizer/cards.json`) for integration, which, while plausible for its stated purpose, is another high-risk cross-skill data access capability.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill may modify local tax records, so incorrect entries could affect later summaries or tax-prep outputs.
The skill instructs the agent to create or update local tax-tracking records. This is expected for an expense tracker and is scoped to a specific workspace path.
Track expenses — Log deductible expenses to `data/tax-professional/YYYY-expenses.json`
Review and approve logged expenses, keep receipts separately, and verify year-end summaries before using them for tax filing.
Personal tax details and expense history may remain in the workspace and be available to future sessions or summaries.
The skill uses persistent user context and stores financial/tax data. This is purpose-aligned, but the data is sensitive and may be reused in future tax interactions.
**First:** Read `USER.md` for the user's employment type, location, filing status, and personal context. ... Store expenses in workspace: `data/tax-professional/YYYY-expenses.json`
Avoid storing unnecessary sensitive identifiers such as SSNs, bank account numbers, or full receipt images unless needed; periodically review or delete stored tax data.
If used with other skills, financial context could be shared beyond the tax tracker.
The skill contemplates cross-skill integration, but the artifact does not detail what tax or expense data would be shared. The integration concept is disclosed and purpose-aligned, so this is a notice rather than a concern.
Integration — Connect with mechanic, card-optimizer, and other skills
Only allow cross-skill use when it is relevant, and confirm what expense or tax details will be shared.
Users may over-rely on generated tax guidance for complex filings or audit-sensitive deductions.
The wording makes a strong professional-advice claim. It fits the skill's purpose, but users should not treat it as a substitute for a licensed tax professional.
provide CPA-level guidance ... Your CPA in the pocket
Use the skill for organization and planning, but verify important or unusual tax positions with current IRS guidance or a qualified tax professional.