China National Pension Calculation

养老金计算器 - 支持Web界面填写和LLM对话交互。计算基本养老金、企业年金、个人养老金和养老储蓄。适用于中国养老金体系计算。

This package appears coherent and local-only, but take the usual precautions before running third-party Node code: 1) Review the repository locally (you already have the files) and inspect any remaining truncated files for network calls or obfuscated code; 2) Run npm install in an isolated environment (container/VM) to avoid unexpected transitive dependency issues; 3) The skill starts local servers (default ports 8082 and 8084) and writes data to data/user-data.json — do not expose these ports to the public internet and avoid entering sensitive identifiers unless you are comfortable storing them locally; 4) If you need stricter assurance, calculate expected outputs from sample inputs or run the server offline and monitor outgoing network activity. If you want, I can scan the remaining truncated files for network endpoints or suspicious patterns before you install.

Type: OpenClaw Skill Name: pension-calculation Version: 1.3.0 The skill bundle provides a pension calculator with a web interface and MCP integration, but it contains significant security vulnerabilities. Specifically, 'mcp-server.js' and 'start-web-server.js' implement a static file server that is vulnerable to directory traversal because it joins the base directory with unsanitized URL paths. Additionally, the 'update_parameter' tool in 'mcp-server.js' is susceptible to prototype pollution when processing nested object keys. While these appear to be unintentional flaws rather than malicious intent, they represent high-risk behaviors that could be exploited to access sensitive local files or manipulate the execution environment.