Klientenportal

Automate RZL Klientenportal.at — a web-based portal by RZL Software for exchanging receipts, invoices, and reports with your tax accountant. Login/logout, up...

Security Scan

The skill's requirements, instructions, and included code are coherent with its stated purpose (automating klientenportal.at via Playwright) and request only the portal credentials they need, but it persists a browser profile and config in the workspace which you should be aware of before use.

Purpose & Capability

Name/description match the implementation: the script automates klientenportal.at using Playwright. Declared binaries (python3, playwright) and required env vars (portal id, user id, password) are appropriate and expected for this functionality.

Instruction Scope

SKILL.md and the script confine actions to driving the portal site (login, upload, list, download). The script does read/write a local config.json and stores a persistent Playwright profile; it does not reference external endpoints other than klientenportal.at. Note: config.json may contain plaintext credentials unless you supply env vars; the script hardens permissions (umask/chmod) but persistence of session data is functionally necessary for the skill.

Install Mechanism

This is instruction-only with an included Python script; there is no automated installer. The dependency (Playwright) is a standard library for browser automation and the README/SETUP instructs using pip and 'playwright install chromium'. No downloads from untrusted URLs or archive extraction are present in the bundle.

Credentials

Only the portal-specific credentials (KLIENTENPORTAL_PORTAL_ID, KLIENTENPORTAL_USER_ID, KLIENTENPORTAL_PASSWORD) are required. The script optionally uses OPENCLAW_WORKSPACE and OPENCLAW_TMP to determine paths; these are reasonable for locating config and temp output. No unrelated secrets or cloud credentials are requested.

Persistence & Privilege

always:false (normal). The skill stores a persistent Chromium user_data_dir under the workspace (CONFIG_DIR/.pw-profile) and writes config.json to the workspace dir or /tmp. This is consistent with the stated behavior, but means cookies/session tokens and possibly downloaded documents remain on disk until you remove them or run logout.

Assessment

This skill appears to do what it says: automate klientenportal.at using Playwright. Before installing: (1) Prefer supplying credentials via the declared env vars rather than putting them in config.json; (2) be aware the skill creates a persistent Playwright profile under your workspace (CONFIG_DIR/.pw-profile) which can hold session cookies—run the provided logout command or remove that directory if you want to clear sessions; (3) install Playwright and Chromium in a controlled environment (or a sandbox/container) per SETUP.md to limit risk; (4) review the included script yourself if you need higher assurance (it contains explicit path resolution, file-permission hardening, and safe-path checks); and (5) verify the workspace path you grant (OPENCLAW_WORKSPACE) is not a privileged or system directory to avoid accidental writes to sensitive locations.

RZL Klientenportal

Automate klientenportal.at — a web portal by RZL Software for securely exchanging accounting documents between clients and their tax accountant.

Entry point: {baseDir}/scripts/klientenportal.py

Setup

See SETUP.md for prerequisites and setup instructions.

Commands

Login / Logout

python3 {baseDir}/scripts/klientenportal.py login          # Test login (validates credentials)
python3 {baseDir}/scripts/klientenportal.py logout         # Clear stored browser session

Upload Documents (Belegübergabe)

Upload receipts/invoices to a specific Belegkreis category:

python3 {baseDir}/scripts/klientenportal.py upload -f invoice.pdf --belegkreis KA
python3 {baseDir}/scripts/klientenportal.py upload -f *.xml --belegkreis SP

Code	Name	Use for
ER	Eingangsrechnungen	Incoming invoices (default)
AR	Ausgangsrechnungen	Outgoing invoices
KA	Kassa	Credit card payments
SP	Sparkasse	Bank account receipts

List Released Files

Show files your accountant has released (freigegebene Dokumente):

python3 {baseDir}/scripts/klientenportal.py released

Received Files (from Accountant)

List files received from your accountant (Kanzleidokumente / Auswertungen):

python3 {baseDir}/scripts/klientenportal.py received              # List all
python3 {baseDir}/scripts/klientenportal.py received -n 5          # Latest 5
python3 {baseDir}/scripts/klientenportal.py received --json         # JSON output

Output columns: Datei, Von, Dokumentbereich, Empfangen

Download Received Files

Download specific files from the received files list:

python3 {baseDir}/scripts/klientenportal.py received-download --latest                  # Latest file
python3 {baseDir}/scripts/klientenportal.py received-download 1 2 3                     # By index (1=latest)
python3 {baseDir}/scripts/klientenportal.py received-download "10-12_2025"              # By name pattern
python3 {baseDir}/scripts/klientenportal.py received-download "10-12_2025" -o ~/Downloads  # Custom output

Single-file downloads are auto-extracted from ZIP wrapper.

Download Kanzleidokumente (Legacy)

Download all available Kanzleidokumente at once:

python3 {baseDir}/scripts/klientenportal.py download                    # To default dir
python3 {baseDir}/scripts/klientenportal.py download -o /path/to/dir    # Custom output dir

Default output: /tmp/openclaw/klientenportal/

Options

• --visible — Show the browser window (useful for debugging or first login)

Recommended Flow

login → upload / released / download → logout

Always call logout after completing all operations to clear the stored browser session.