Tax Professional Advance

• Analyzed: Apr 22, 2026, 2:26 AM
• Findings: 1
• Version: 1.0.3
• Hash: 4a22d464dcde1886a732177bdcfee9fbcd90239c6a2344c2b4bca1f696e8b25a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The tax-professional-advance skill provides comprehensive tax advisory services but utilizes high-risk capabilities, including instructions for the agent to execute 'clawdbot cron' commands for persistence and to access sensitive data files from other skills (e.g., 'data/mechanic/state.json' and 'data/card-optimizer/cards.json'). While these behaviors are plausibly aligned with the stated goals of providing proactive tax reminders and identifying deductions across different expense categories, the use of scheduled command execution and cross-skill data access represents a significant attack surface. No evidence of intentional malice, such as data exfiltration or unauthorized remote control, was found in SKILL.md or the associated documentation.