South African Tax Article Generator

Generate South African tax/VAT/SARS compliance articles

This package appears to be a benign article generator, but the documentation and the code disagree in several ways. Before installing or enabling it for production: 1) review the code yourself or run it in a sandbox — index.py only writes JSON files and does not publish to WordPress or schedule tasks despite the SKILL.md claiming those features; 2) note a functional bug: templates use Jinja-style {{VAR}} placeholders but index.py uses Python's string.Template (which expects $var), so generated content will likely retain raw {{...}} placeholders; 3) the SKILL.md mentions templates/ and schemas/ directories that are not present — ask the author for the missing files or an updated README; 4) verify CTA_URL handling (the CLI requires --cta-url but SKILL.md's input table omits it) to avoid runtime surprises; 5) if you need the advertised WordPress publishing or scheduled triggers, request a version that actually implements and documents those features; and 6) because the mismatches could stem from sloppy packaging, prefer testing locally in an isolated environment and do not grant any credentials unless the implementation explicitly needs and documents them. If the author provides corrected SKILL.md and/or the missing files and fixes the templating bug, reassess — at that point the skill would likely be coherent and low-risk.

Type: OpenClaw Skill Name: tax-article-generator Version: 1.0.0 The skill is suspicious due to a significant prompt injection vulnerability. The `index.py` script uses `string.Template.safe_substitute()` to insert user-controlled input variables (defined in `SKILL.md`) directly into markdown article templates without any sanitization. This allows an attacker to inject arbitrary markdown or OpenClaw agent instructions into the generated content, which could then be executed by the agent or a downstream system if it processes the output.