Tax Professional

Comprehensive US tax advisor, deduction optimizer, and expense tracker. Covers all employment types (W-2, 1099, S-Corp, mixed), estimated tax payments, audit risk assessment, life event triggers, multi-state filing, RV-as-home rules, tax bracket optimization, document retention, and proactive year-round tax calendar nudges. Your CPA in the pocket.

This skill appears to do what it says — read USER.md, advise, and store expense data in a per-year JSON file in your workspace — and it does not request external credentials or install anything. Before installing/use, consider: (1) Workspace privacy: the skill will store potentially sensitive financial and personal data in data/tax-professional/YYYY-expenses.json in plain JSON — ensure your workspace is private/backed up/encrypted or plan to delete/secure these files. (2) Notifications & integrations: ask how 'proactive reminders' are delivered and whether the skill will call other skills or external services (that could transmit your data). (3) Verification: treat tax advice as guidance, not a substitute for a licensed CPA for complex situations. (4) Retention policy: confirm whether and how long data is kept, and whether you can export/delete records. If you need stricter privacy, require the skill to encrypt stored files or avoid storing persistent records in the workspace.

Type: OpenClaw Skill Name: tax-professional Version: 1.0.1 The skill is classified as suspicious due to its use of `clawdbot cron add` commands in `SKILL.md`. These commands instruct the agent to create persistent scheduled tasks that send messages to an external channel (Telegram). While the messages themselves are benign tax reminders and align with the stated purpose of 'proactive year-round tax calendar nudges', the direct execution of system commands, creation of persistence, and use of external communication channels represent high-risk capabilities that could be repurposed for malicious activities if the skill were compromised or designed with ill intent. Additionally, the skill is instructed to read data from other skills' workspaces (`data/mechanic/state.json`, `data/card-optimizer/cards.json`) for integration, which, while plausible for its stated purpose, is another high-risk cross-skill data access capability.