ClawHub

Revolut Business

v1.0.1

Revolut Business API CLI — accounts, balances, transactions, counterparties, payments, FX exchange, CSV export. Auto-refreshes OAuth tokens. Business accounts only (not personal).

⭐ 1· 1.6k·0 current·0 all-time
by@christianhaberl
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The skill's name, README, SKILL.md and scripts implement a Revolut Business CLI and only require python3 — that matches the stated purpose. However the registry metadata claims no required environment variables/primary credential even though the code expects REVOLUT_CLIENT_ID and REVOLUT_ISS_DOMAIN and stores keys/tokens under ~/.clawdbot/revolut. The omission in metadata is an inconsistency.
!
Instruction Scope
SKILL.md and setup.py largely stay within the Revolut onboarding and API usage flow (generate RSA key, upload X509 cert, OAuth code exchange, token refresh). But the runtime code includes a load_env() routine that will read other .env files (e.g., ~/clawd/.env and a parent-path .env) to populate credentials if not set in the environment — this reads user workspace env files outside the skill's directory and could surface unrelated secrets. setup.py also runs shell commands (openssl, curl, clipboard tools) and performs network calls during interactive setup — expected for setup, but worth noting.
✓
Install Mechanism
No external install spec or remote downloads — the skill is instruction+script based and uses standard Python libraries (PyJWT, cryptography). Nothing is being fetched from untrusted URLs or executed from arbitrary archives in the manifest.
!
Credentials
The functionality legitimately needs a client ID, issuer domain and a private key/certificate. But the registry metadata doesn't declare the required env vars (REVOLUT_CLIENT_ID, REVOLUT_ISS_DOMAIN). Additionally, load_env() attempts to read unrelated .env files (e.g. ~/clawd/.env or a .env found by walking up directories), which is disproportionate for this CLI and risks accidentally exposing unrelated secrets.
✓
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system-wide settings. It persists credentials under ~/.clawdbot/revolut which is appropriate for a CLI; ensure the directory and files have tight permissions.
What to consider before installing
What to consider before installing/running: - Provenance: the skill's source is listed as unknown; the README points to a GitHub repo. Prefer installing or running code from a known, trusted upstream and compare the files to that upstream repo. - Metadata mismatch: the code requires REVOLUT_CLIENT_ID and REVOLUT_ISS_DOMAIN and creates private.pem/certificate.pem/tokens.json, but the registry metadata does not declare these env vars/credentials — treat this as a red flag and verify values yourself. - Sensitive files: the skill will generate and store an RSA private key and OAuth tokens in ~/.clawdbot/revolut. Set strict filesystem permissions (chmod 700 ~/.clawdbot/revolut, chmod 600 private.pem/tokens.json) and only run on machines you control. - Unexpected .env access: the code tries to load a .env from ~/clawd/.env and a parent-directory .env as a fallback. If you have other secrets in such files, the skill may read them. Either remove/lock those .env files or edit the script to stop reading them before running. - Interactive setup behaviors: setup.py runs local shell commands (openssl, clipboard utilities), queries ifconfig.me for the public IP, and opens browsers. Run setup interactively on a secure host and inspect the script if you have concerns. - Review JWT claims/audience: the scripts set aud to https://revolut.com and call the b2b API; this is consistent in the included code but verify with Revolut docs for your account. - Least privilege: don't run this on a shared CI runner or multi-user server where other users could access ~/.clawdbot/revolut. Consider running inside a dedicated VM or container. If you are not comfortable, ask the publisher for the canonical repo URL and sign-off, or request that the skill metadata be corrected to list required env vars before installation.

Like a lobster shell, security has layers — review code before you run it.

latestvk976dwcpdnbmrxty63hcgp382s809fh6

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

💶 Clawdis
Binspython3

Comments