Security audit
Security checks across malware telemetry and agentic risk
The skill is mostly transparent about Monzo banking access, but it needs Review because it can keep ongoing bank access and perform account-changing actions without built-in confirmation.
Install only if you are comfortable giving an agent persistent Monzo API access. Use it on a machine you control, protect MONZO_KEYRING_PASSWORD, avoid putting real secrets in shell history or shared config, review Monzo connected apps regularly, and require your own explicit confirmation before any pot movement, receipt deletion, transaction annotation, feed notification, or webhook change.
The following are stored in the encrypted credentials file: - OAuth Client ID and Client Secret - Access Token and Refresh Token - Default Account ID ### What This Skill Does NOT Protect Against
"monzo": {
enabled: true,
env: {
"MONZO_KEYRING_PASSWORD": "choose-a-secure-password-here"
}
}
}echo "$json" | openssl enc -aes-256-cbc \
-salt -pbkdf2 -iter 100000 \
-pass env:MONZO_KEYRING_PASSWORD \
-out "$CREDENTIALS_FILE" 2>/dev/null
}openssl enc -aes-256-cbc -d \
-salt -pbkdf2 -iter 100000 \
-pass env:MONZO_KEYRING_PASSWORD \
-in "$CREDENTIALS_FILE" 2>/dev/null || {
echo "Error: Failed to decrypt credentials (wrong password?)" >&2
return 1echo "$json" | openssl enc -aes-256-cbc \
-salt -pbkdf2 -iter 100000 \
-pass env:MONZO_KEYRING_PASSWORD \
-out "$CREDENTIALS_FILE" 2>/dev/null
chmod 600 "$CREDENTIALS_FILE"openssl enc -aes-256-cbc -d \
-salt -pbkdf2 -iter 100000 \
-pass env:MONZO_KEYRING_PASSWORD \
-in "$CREDENTIALS_FILE" 2>/dev/null
}echo "This password is used to encrypt your Monzo credentials." echo "Add it to your shell environment or OpenClaw config:" echo "" echo " export MONZO_KEYRING_PASSWORD='your-secure-password'" echo "" exit 1 fi
EXPIRES_IN=$(jq -r '.expires_in // 21600' <<< "$TOKEN_RESPONSE") if [[ -z "$ACCESS_TOKEN" || "$ACCESS_TOKEN" == "null" ]]; then print_error "Failed to obtain access token" echo "Response: $TOKEN_RESPONSE" exit 1 fi
exit 1 fi response=$(monzo_api_call DELETE "/transaction-receipts?external_id=$EXTERNAL_ID") echo "✓ Receipt deleted" exit 0
66/66 vendors flagged this skill as clean.
No suspicious patterns detected.