Tax Calculator Cn
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user expecting only tax calculations could be presented with unrelated finance-tracking commands and may misunderstand what the skill is doing.
This bundled script presents a finance-tracking tool rather than the advertised Chinese personal income tax calculator, creating a material mismatch between the stated purpose and available behavior.
Financial tracking and analysis tool ... Commands: track, balance, summary, export, budget, history
Remove the unrelated tracker script, or clearly disclose it in SKILL.md and make the command names and examples match the actual intended entry point.
Financial inputs or transaction descriptions could remain on disk after use, where future sessions or local users may find them.
The script creates persistent local storage and appends command activity to a history log, which may include user-entered financial descriptions, but this storage is not disclosed in the skill description.
DATA_DIR="${TAX_CALCULATOR_CN_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/tax-calculator-cn}" ... _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }Disclose exactly what is stored, where it is stored, how long it is retained, and provide a cleanup or opt-out mechanism.
The skill may fail or may run a different bundled script than the user expects, depending on how the command is wired.
The calculator script depends on python3, while the registry requirements declare no required binaries and there is no install spec, leaving the execution contract unclear.
python3 - "$@" << 'PYTHON_SCRIPT'
Declare python3 as a requirement and provide a clear install or invocation specification for the intended tax calculator command.