Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

South African Tax Article Generator

v1.0.0

Generate South African tax/VAT/SARS compliance articles

0· 315·0 current·0 all-time
byCarl Luis Olivier@wespeakallday
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill claims optional WordPress REST API integration, scheduled triggers, and includes 'schemas/' and 'templates/' directories in SKILL.md, but the package contains only index.py and SKILL.md. index.py implements local JSON output only and does not perform publishing or scheduling. The mismatch between claimed capabilities and actual code is disproportionate.
!
Instruction Scope
SKILL.md lists input variables (including CTA_TEXT) but omits CTA_URL which is required by the CLI; the README describes Jinja2 templates and JSON schemas but index.py uses inlined template strings and the string.Template API. Also SKILL.md mentions triggers and webhooks, but there are no instructions or code to interact with external systems or scheduling. These divergences give the agent broader discretion in documentation than the code actually uses.
Install Mechanism
No install spec is provided (instruction-only with a single Python file). That minimizes installation risk — nothing is downloaded or executed at install time beyond the included index.py.
Credentials
The skill declares no required environment variables or credentials and the code does not read secrets or external config. There are no disproportionate credential requests.
Persistence & Privilege
always is false, the skill doesn't request persistent/privileged platform presence, and the code writes only to the user-specified output directory. No modifications to other skills or global agent config are present.
What to consider before installing
This package appears to be a benign article generator, but the documentation and the code disagree in several ways. Before installing or enabling it for production: 1) review the code yourself or run it in a sandbox — index.py only writes JSON files and does not publish to WordPress or schedule tasks despite the SKILL.md claiming those features; 2) note a functional bug: templates use Jinja-style {{VAR}} placeholders but index.py uses Python's string.Template (which expects $var), so generated content will likely retain raw {{...}} placeholders; 3) the SKILL.md mentions templates/ and schemas/ directories that are not present — ask the author for the missing files or an updated README; 4) verify CTA_URL handling (the CLI requires --cta-url but SKILL.md's input table omits it) to avoid runtime surprises; 5) if you need the advertised WordPress publishing or scheduled triggers, request a version that actually implements and documents those features; and 6) because the mismatches could stem from sloppy packaging, prefer testing locally in an isolated environment and do not grant any credentials unless the implementation explicitly needs and documents them. If the author provides corrected SKILL.md and/or the missing files and fixes the templating bug, reassess — at that point the skill would likely be coherent and low-risk.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fme88qqh9yjjywy6wjn19a5829239
315downloads
0stars
1versions
Updated 9h ago
v1.0.0
MIT-0

Tax/VAT Article Generator Skill

Overview

Automated generation of South African tax compliance articles covering SARS deadlines, VAT, PAYE, and provisional tax.

Purpose

  • Generate SEO-optimized tax articles for PayLessTax blog
  • Ensure SARS deadline accuracy and compliance information
  • Create structured content with JSON schemas for automation

Input Variables (Template Placeholders)

VariableDescriptionExample
ARTICLE_TITLEComplete article titleSARS 2026 Tax Season: Essential Compliance Dates
MAIN_KEYWORDPrimary SEO keywordSARS 2026 compliance
YEARTax year2026
DEADLINE_1_DATEFirst deadline date31 August 2026
DEADLINE_1_NAMEFirst deadline descriptionProvisional Tax First Period
DEADLINE_2_DATESecond deadline date28 February 2027
DEADLINE_3_DATEThird deadline date30 September 2027
PENALTY_INFOPenalty information10% of tax payable
INTEREST_RATEInterest rate formularepo rate + 4%
CTA_TEXTCall-to-actionDownload our checklist

Article Types

SARS Compliance Guide

  • Year-specific deadline overview
  • Provisional tax due dates
  • Annual return windows
  • VAT submission schedules
  • Penalty information

VAT Article

  • VAT 201 form details
  • Category A/B/C/D/E schedules
  • Late submission penalties
  • Input/output tax rules

PAYE Article

  • EMP201 submission dates
  • Monthly filing requirements
  • UIF/SDL components

Provisional Tax Guide

  • IRP6 form instructions
  • First, second, third periods
  • Estimated tax calculations
  • Penalties for underestimation

Output Schema

{
  "title": "generated title",
  "author": "PayLessTax Team",
  "content": "# Markdown content...",
  "seo_metadata": {...}
}

Triggers

  • Scheduled tax calendar events
  • Manual CLI execution
  • WordPress/WooCommerce webhook (optional)

APIs & Dependencies

  • Built-in Python (no external APIs)
  • No secrets required (content generation only)
  • Optional: WordPress REST API for publishing

Files

  • index.py - Article generator logic
  • schemas/ - JSON schemas for each article type
  • templates/ - Jinja2 templates

Comments

Loading comments...