Klientenportal
v1.5.1Automate RZL Klientenportal.at — a web-based portal by RZL Software for exchanging receipts, invoices, and reports with your tax accountant. Login/logout, up...
⭐ 0· 878·1 current·1 all-time
byOliver Drobnik@odrobnik
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the implementation: the script automates klientenportal.at using Playwright. Declared binaries (python3, playwright) and required env vars (portal id, user id, password) are appropriate and expected for this functionality.
Instruction Scope
SKILL.md and the script confine actions to driving the portal site (login, upload, list, download). The script does read/write a local config.json and stores a persistent Playwright profile; it does not reference external endpoints other than klientenportal.at. Note: config.json may contain plaintext credentials unless you supply env vars; the script hardens permissions (umask/chmod) but persistence of session data is functionally necessary for the skill.
Install Mechanism
This is instruction-only with an included Python script; there is no automated installer. The dependency (Playwright) is a standard library for browser automation and the README/SETUP instructs using pip and 'playwright install chromium'. No downloads from untrusted URLs or archive extraction are present in the bundle.
Credentials
Only the portal-specific credentials (KLIENTENPORTAL_PORTAL_ID, KLIENTENPORTAL_USER_ID, KLIENTENPORTAL_PASSWORD) are required. The script optionally uses OPENCLAW_WORKSPACE and OPENCLAW_TMP to determine paths; these are reasonable for locating config and temp output. No unrelated secrets or cloud credentials are requested.
Persistence & Privilege
always:false (normal). The skill stores a persistent Chromium user_data_dir under the workspace (CONFIG_DIR/.pw-profile) and writes config.json to the workspace dir or /tmp. This is consistent with the stated behavior, but means cookies/session tokens and possibly downloaded documents remain on disk until you remove them or run logout.
Assessment
This skill appears to do what it says: automate klientenportal.at using Playwright. Before installing: (1) Prefer supplying credentials via the declared env vars rather than putting them in config.json; (2) be aware the skill creates a persistent Playwright profile under your workspace (CONFIG_DIR/.pw-profile) which can hold session cookies—run the provided logout command or remove that directory if you want to clear sessions; (3) install Playwright and Chromium in a controlled environment (or a sandbox/container) per SETUP.md to limit risk; (4) review the included script yourself if you need higher assurance (it contains explicit path resolution, file-permission hardening, and safe-path checks); and (5) verify the workspace path you grant (OPENCLAW_WORKSPACE) is not a privileged or system directory to avoid accidental writes to sensitive locations.Like a lobster shell, security has layers — review code before you run it.
latestvk97dz1gm9gtg0vb6eqvs24eyx9827zhh
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📋 Clawdis
Binspython3, playwright
EnvKLIENTENPORTAL_PORTAL_ID, KLIENTENPORTAL_USER_ID, KLIENTENPORTAL_PASSWORD