TaxClaw

Extract, store, and export tax documents (W-2, 1099-DA, all 1099 variants, K-1) using AI. Local-first — your documents never leave your machine. Web UI at lo...

TaxClaw appears internally consistent with its claim to be a local-first tax document extractor. Before installing: (1) Review setup.sh and requirements.txt — setup will create a venv and pip-install packages from PyPI. (2) Confirm you are happy with local storage at ~/.local/share/taxclaw and ~/.config/taxclaw (these will contain sensitive extracted data). (3) Keep cloud mode disabled unless you intentionally set cloud_api_key / ANTHROPIC_API_KEY and set privacy_acknowledged in config.yaml — cloud mode will send excerpts to Anthropic. (4) Optionally inspect the included source (or the GitHub repo referenced in SKILL.md) if you want to audit network/IO behavior before running setup.sh. Overall this skill is coherent and behaves as described, but installing software and dependencies always carries the usual supply-chain and local-data risks.

Type: OpenClaw Skill Name: taxclaw Version: 0.1.1 The OpenClaw skill 'taxclaw' is designed with strong security and privacy considerations. It is local-first by default, processing all tax documents and extracted data on the user's machine. The optional cloud AI mode is explicitly opt-in, requiring user acknowledgment of privacy implications. The code implements robust defenses against prompt injection by instructing the AI model to treat document content as untrusted data and to ignore embedded instructions (src/ai.py, src/extract.py). File uploads are secured with size limits, extension allowlists, and magic-byte sniffing (src/store.py). The web UI includes CSRF protection and enforces loopback host/origin checks (src/main.py). All network and file system access is aligned with the stated purpose of a local tax document extraction tool, and there is no evidence of intentional harmful behavior, unauthorized data exfiltration, or persistence mechanisms.