Tax Calculator Cn

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: tax-calculator-cn Version: 2.0.0 The skill bundle is a legitimate Chinese tax calculator and financial tracking tool. The scripts (tax.sh and script.sh) perform local calculations and basic logging to a user-controlled data directory without any evidence of network exfiltration, sensitive file access, or malicious prompt injection.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI09: Human-Agent Trust Exploitation

What this means

A user expecting only tax calculations could be presented with unrelated finance-tracking commands and may misunderstand what the skill is doing.

Why it was flagged

This bundled script presents a finance-tracking tool rather than the advertised Chinese personal income tax calculator, creating a material mismatch between the stated purpose and available behavior.

Skill content

Financial tracking and analysis tool ... Commands: track, balance, summary, export, budget, history

Recommendation

Remove the unrelated tracker script, or clearly disclose it in SKILL.md and make the command names and examples match the actual intended entry point.

Concern

ASI06: Memory and Context Poisoning

What this means

Financial inputs or transaction descriptions could remain on disk after use, where future sessions or local users may find them.

Why it was flagged

The script creates persistent local storage and appends command activity to a history log, which may include user-entered financial descriptions, but this storage is not disclosed in the skill description.

Skill content

DATA_DIR="${TAX_CALCULATOR_CN_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/tax-calculator-cn}" ... _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

Recommendation

Disclose exactly what is stored, where it is stored, how long it is retained, and provide a cleanup or opt-out mechanism.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may fail or may run a different bundled script than the user expects, depending on how the command is wired.

Why it was flagged

The calculator script depends on python3, while the registry requirements declare no required binaries and there is no install spec, leaving the execution contract unclear.

Skill content

python3 - "$@" << 'PYTHON_SCRIPT'

Recommendation

Declare python3 as a requirement and provide a clear install or invocation specification for the intended tax calculator command.