Starling Bank

Manage Starling Bank accounts via the starling-bank-mcp server. Check balances, list transactions, create payees, make payments, manage savings goals, and tr...

This skill appears to be a legitimate Starling Bank integration, but the runtime instructions and the registry metadata don't match. Before installing or using it: (1) verify the starling-bank-mcp package origin and inspect its source (npm package page / GitHub repo) to ensure it's the expected implementation; (2) confirm you have and trust the mcporter tool the skill expects; (3) do not paste your STARLING_BANK_ACCESS_TOKEN until you verify the package and mcporter invocation; (4) prefer storing sensitive tokens in a secure secrets manager rather than agent memory/config; (5) ask the publisher to update the skill metadata to declare required env vars (STARLING_BANK_ACCESS_TOKEN) and required binaries (mcporter, node/npm) so the declared requirements match the instructions. If you cannot verify the npm package and mcporter behavior, avoid installing or providing credentials.

Type: OpenClaw Skill Name: starling-bank Version: 1.0.0 The skill is classified as suspicious due to its inherent high-risk capabilities, which include making payments, creating payees, managing savings goals (deposits/withdrawals), and locking/unlocking bank cards, as detailed in `SKILL.md` and `references/api-details.md`. While these actions are explicitly aligned with the stated purpose of 'Manage Starling Bank accounts' and lack clear malicious intent (e.g., no data exfiltration, backdoors, or prompt injection for unauthorized actions), the nature of these financial operations constitutes 'meaningful high-risk behaviors' that prevent a 'benign' classification. The skill transparently instructs the agent to install the `starling-bank-mcp` npm package and configure it with a personal access token, which are standard but still involve external dependencies and sensitive credentials.