by 安全扫描
OpenClaw
安全
high confidenceThe skill's requirements, instructions, and included code are coherent with its stated purpose (automating klientenportal.at via Playwright) and request only the portal credentials they need, but it persists a browser profile and config in the workspace which you should be aware of before use.
评估建议
This skill appears to do what it says: automate klientenportal.at using Playwright. Before installing: (1) Prefer supplying credentials via the declared env vars rather than putting them in config.json; (2) be aware the skill creates a persistent Playwright profile under your workspace (CONFIG_DIR/.pw-profile) which can hold session cookies—run the provided logout command or remove that directory if you want to clear sessions; (3) install Playwright and Chromium in a controlled environment (or a...详细分析 ▾
✓ 用途与能力
Name/description match the implementation: the script automates klientenportal.at using Playwright. Declared binaries (python3, playwright) and required env vars (portal id, user id, password) are appropriate and expected for this functionality.
ℹ 指令范围
SKILL.md and the script confine actions to driving the portal site (login, upload, list, download). The script does read/write a local config.json and stores a persistent Playwright profile; it does not reference external endpoints other than klientenportal.at. Note: config.json may contain plaintext credentials unless you supply env vars; the script hardens permissions (umask/chmod) but persistence of session data is functionally necessary for the skill.
✓ 安装机制
This is instruction-only with an included Python script; there is no automated installer. The dependency (Playwright) is a standard library for browser automation and the README/SETUP instructs using pip and 'playwright install chromium'. No downloads from untrusted URLs or archive extraction are present in the bundle.
✓ 凭证需求
Only the portal-specific credentials (KLIENTENPORTAL_PORTAL_ID, KLIENTENPORTAL_USER_ID, KLIENTENPORTAL_PASSWORD) are required. The script optionally uses OPENCLAW_WORKSPACE and OPENCLAW_TMP to determine paths; these are reasonable for locating config and temp output. No unrelated secrets or cloud credentials are requested.
ℹ 持久化与权限
always:false (normal). The skill stores a persistent Chromium user_data_dir under the workspace (CONFIG_DIR/.pw-profile) and writes config.json to the workspace dir or /tmp. This is consistent with the stated behavior, but means cookies/session tokens and possibly downloaded documents remain on disk until you remove them or run logout.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.5.12026/2/13
fix: use /Users/oliver/clawd for workspace root to preserve symlink paths
● 无害
安装命令 点击复制
官方npx clawhub@latest install klientenportal
镜像加速npx clawhub@latest install klientenportal --registry https://cn.clawhub-mirror.com
技能文档
Automate klientenportal.at — a web portal by RZL Software for securely exchanging accounting documents between clients and their tax accountant.
Entry point: {baseDir}/scripts/klientenportal.py
Setup
See SETUP.md for prerequisites and setup instructions.
Commands
登录 / 登出
python3 {baseDir}/scripts/klientenportal.py login # Test login (validates credentials)
python3 {baseDir}/scripts/klientenportal.py logout # Clear stored browser session
上传 Documents (Belegübergabe)
Upload receipts/invoices to a specific Belegkreis category:
python3 {baseDir}/scripts/klientenportal.py upload -f invoice.pdf --belegkreis KA
python3 {baseDir}/scripts/klientenportal.py upload -f *.xml --belegkreis SP
| Code | Name | Use for |
|---|---|---|
| ER | Eingangsrechnungen | Incoming invoices (default) |
| AR | Ausgangsrechnungen | Outgoing invoices |
| KA | Kassa | Credit card payments |
| SP | Sparkasse | Bank account receipts |
列表 Released Files
Show files your accountant has released (freigegebene Dokumente):
python3 {baseDir}/scripts/klientenportal.py released
Received Files (从 Accountant)
List files received from your accountant (Kanzleidokumente / Auswertungen):
python3 {baseDir}/scripts/klientenportal.py received # List all
python3 {baseDir}/scripts/klientenportal.py received -n 5 # Latest 5
python3 {baseDir}/scripts/klientenportal.py received --json # JSON output
Output columns: Datei, Von, Dokumentbereich, Empfangen
下载 Received Files
Download specific files from the received files list:
python3 {baseDir}/scripts/klientenportal.py received-download --latest # Latest file
python3 {baseDir}/scripts/klientenportal.py received-download 1 2 3 # By index (1=latest)
python3 {baseDir}/scripts/klientenportal.py received-download "10-12_2025" # By name pattern
python3 {baseDir}/scripts/klientenportal.py received-download "10-12_2025" -o ~/Downloads # Custom output
Single-file downloads are auto-extracted from ZIP wrapper.
下载 Kanzleidokumente (Legacy)
Download all available Kanzleidokumente at once:
python3 {baseDir}/scripts/klientenportal.py download # To default dir
python3 {baseDir}/scripts/klientenportal.py download -o /path/to/dir # Custom output dir
Default output: /tmp/openclaw/klientenportal/
Options
--visible— Show browser window (useful 对于 debugging 或 第一个 登录)
Recommended Flow
login → upload / released / download → logout
Always call logout after completing all operations to clear the stored browser session.
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制