Monarch Money

Access Monarch Money financial data: accounts, transactions, budgets, and cashflow. Use when the user asks about their finances, spending, account balances,...

This wrapper appears to do what it claims: it installs the monarchmoney Python library, prompts you for your Monarch email/password and MFA once, then saves a session token at ~/.monarchmoney/mm_session.pickle for future use. Before installing, verify the 'monarchmoney' pip package source (use a virtualenv), review its repository if possible, and ensure you trust the environment where you'll store the session file. Treat the session file as sensitive (restrict filesystem permissions). Remember the agent can invoke the skill by default — if you don't want autonomous access to your finances, disable model invocation or avoid installing the skill.

Type: OpenClaw Skill Name: monarch Version: 1.0.0 The monarch skill facilitates access to sensitive financial data using the monarchmoney library, which is a high-risk capability. While the code aligns with its stated purpose, it contains security vulnerabilities: scripts/login_setup.py uses input() for password collection, potentially exposing credentials in terminal history, and both scripts use Python's pickle module to store and load session data in ~/.monarchmoney/mm_session.pickle, which is susceptible to insecure deserialization attacks if the local file system is compromised.