Is robbalian/claude-tax-filing safe?
Use with caution. robbalian/claude-tax-filing is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the claude-tax-filing skill by robbalian a trust score of 74/100 with 3 findings (1 critical).
https://github.com/robbalian/claude-tax-filing
Is robbalian/claude-tax-filing safe to install?
This tax preparation skill appears functionally legitimate but exhibits concerning behavior by accessing sensitive credential files during installation. While no data exfiltration was detected, this unauthorized file access represents a significant security risk.
What security issues were found in robbalian/claude-tax-filing?
Category Scores
Findings (3)
CRITICAL Unauthorized Access to Sensitive Credential Files -80 ▶
The skill accessed multiple sensitive credential files including .env, SSH private keys, AWS credentials, NPM credentials, Docker credentials, and Google Cloud credentials. While no exfiltration was detected, accessing these files is not justified for a tax preparation tool.
MEDIUM Executable Python Scripts Present -15 ▶
The skill contains three Python scripts for PDF manipulation (verify_filled.py, discover_fields.py, fill_forms.py). While these appear legitimate for tax preparation, they represent executable code that could be modified.
LOW Downloads External Content -5 ▶
The skill instructs the agent to download PDF forms from external URLs, albeit from legitimate government websites (IRS.gov, FTB.ca.gov).
Should I install robbalian/claude-tax-filing?
Oathe's verdict for robbalian/claude-tax-filing is CAUTION with a trust score of 74/100. Recommendation: Install with caution.