raiffeisen-elba

Automate Raiffeisen ELBA online banking: login/logout, list accounts, and fetch transactions via Playwright.

This skill legitimately automates ELBA by controlling a browser and extracting a short-lived bearer token; that is why it needs your ELBA ID and PIN in a local config.json and why it inspects browser storage or outgoing requests. Before installing or running it: 1) Audit the code yourself or run it in an isolated/trusted environment (not on a shared or production machine). 2) Keep config.json permissions strict (chmod 600) as recommended and consider removing the PIN after use if you can. 3) Only run login operations when you can approve the pushTAN on your device; always run the provided logout command to delete .pw-profile/token cache. 4) Be aware Playwright will download browser binaries during setup (network activity). 5) If you are uncomfortable with local token extraction or storing credentials on disk, do not use this skill with real bank credentials.

Type: OpenClaw Skill Name: raiffeisen-elba Version: 1.4.4 The skill provides automation for Raiffeisen ELBA banking via Playwright and internal API calls. While it handles highly sensitive data (bank credentials and session tokens), it implements exemplary security practices, including strict file permissions (0600/0700), a global restrictive umask (0077), and robust path sanitization in `elba.py` to prevent directory traversal. All network traffic is confined to official bank domains (*.raiffeisen.at), and the documentation (SECURITY.md) transparently details the bearer token extraction process and session lifecycle management.