openfin-enable-banking

PSD2 Open Banking integration via Enable Banking API. Connect DACH bank accounts (Sparkasse, Volksbank, Deutsche Bank, Commerzbank, DKB, ING, Postbank + Aust...

This package implements a legitimate-looking Enable Banking integration, but review and prepare before installing: 1) Provide a config.json with 'applicationId' and 'keyPath' (the private key file must exist and be kept secret). 2) Install Python dependencies (PyJWT, cryptography, requests) and ensure the system 'openssl' binary is available — the callback server uses openssl via subprocess to generate certs but the skill metadata does not declare that dependency. 3) The callback server listens on network interfaces (default 0.0.0.0:8443) and will write files to .keys/, mandanten/, data/, and pending_callbacks/ in the skill directory; run this in an isolated environment and review permissions. 4) The onboarding flow prints an authorization URL to stdout that your agent/operator is expected to forward externally — ensure the channel used to forward it is secure and avoid leaking auth codes. 5) Verify the API base (api.enablebanking.com) and that you intend to register an application with Enable Banking; do not use production private keys with untrusted or third-party code. If you want to proceed, update the skill metadata or documentation to declare the openssl dependency and the file-based config/key requirements, and run the code in a sandbox or VM first.

Type: OpenClaw Skill Name: openfin-enable-banking Version: 1.0.0 The skill bundle provides a functional PSD2 banking integration but contains a path traversal vulnerability in `scripts/callback_server.py`. The `state` query parameter from the OAuth callback is used without sanitization to construct a file path (`PENDING_DIR / f'{state}.json'`), which could allow an attacker to write JSON files to arbitrary locations on the filesystem. Furthermore, the callback server binds to `0.0.0.0`, making it accessible over the network, and uses `subprocess.run` to execute `openssl` for certificate generation. While these appear to be unintentional security flaws rather than malicious intent, they represent a significant risk surface.