Credential Manager

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:44 AM UTC
• Version: 1.3.0

Overview

This skill has a legitimate security purpose, but it asks for broad access to sensitive credentials and can persist, copy, modify, and delete secret-bearing files with under-scoped safeguards.

Install only if you intentionally want this skill to inspect and migrate credential files. Run scan-only first, review every path, avoid --yes for real migrations, verify ~/.openclaw/.env and backups before cleanup, do not consolidate wallet seed phrases or private keys unless you have a strong reason, and avoid sourcing or printing secrets in shell sessions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation clearly describes capabilities to read credential files, write consolidated secrets, modify .gitignore, and invoke shell scripts, but it does not declare any explicit permission model or scope boundaries. That mismatch increases the risk of over-broad execution and makes it harder for users or a platform to enforce least privilege around sensitive filesystem and shell access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example explicitly sources the root .env and then prints a credential with `echo`, which encourages secret disclosure to terminal history, logs, CI output, screen recordings, or shell wrappers. In a credential-management skill, demonstrating direct secret output is especially risky because users are likely to copy the pattern into real operational scripts.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The document imposes an absolute, one-size-fits-all credential policy with 'no exceptions,' including rejecting shell environment variables, despite legitimate deployment contexts like CI/CD, containers, and managed secret stores that require different handling. In a security foundation document, this rigidity can push users toward insecure workarounds, reduce compatibility with safer platform-native secret mechanisms, and create operational failures that lead to weaker real-world security.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README explicitly says the skill cleans up scattered credential files after migration, but it does not prominently warn users to verify backups and the new consolidated file before deletion. Because the skill operates on secret-bearing files, unclear deletion safeguards can cause accidental credential loss or break applications if migration is incomplete.

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: The skill mandates a single credential storage policy and explicitly says users are 'forced to fix it,' which removes operator choice and can trigger denial-of-service behavior for dependent skills if the policy is not met. Even when the goal is security, hard enforcement without a documented opt-in, exception path, or policy authority can create unsafe operational pressure and brittle workflows.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Interactive mode (prompts before changes)
./scripts/consolidate.py

# Auto-confirm (no prompts)
./scripts/consolidate.py --yes

# Backup only

• Confidence: 81% confidence
• Finding: The documented '--yes' auto-confirm mode enables the skill to perform credential consolidation and related filesystem changes without interactive review. In a skill that scans for secrets and later cleans up old files, unattended execution increases the chance of unintended modification, migration mistakes, or destructive follow-on actions if invoked in the wrong context.

Credential Access

High

• Category: Privilege Escalation

Content

The skill automatically detects credentials by scanning for:

**File Patterns:**
- `credentials.json` files in config directories
- `.env` files
- Memory files with `-creds` or `credentials` in the name

• Confidence: 95% confidence
• Finding: The skill is explicitly designed to scan for and collect credentials from multiple locations, including credentials.json and .env files. Any skill with broad secret discovery and aggregation behavior is highly sensitive because compromise, misuse, or implementation flaws could expose many credentials at once and expand the blast radius beyond a single application.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: credential-manager
description: MANDATORY security foundation for OpenClaw. Consolidate scattered API keys and credentials into a secure .env file with proper permissions. Use when setting up OpenClaw, migrating credentials, auditing security, or enforcing the .env standard. This is not optional — centralized credential management is a core requirement for secure OpenClaw deployments. Scans for credential files across common locations, backs up existing files, creates a unified .env with mode 600, validates security, and enforces best practices.
---

# Credential Manager

• Confidence: 92% confidence
• Finding: This duplicate metadata finding still reflects real risk: the skill's core purpose is broad credential handling. The danger is amplified by its framing as mandatory and foundational, which may pressure users into running a high-privilege secret-management workflow without carefully evaluating whether centralized plaintext storage fits their environment.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: credential-manager
description: MANDATORY security foundation for OpenClaw. Consolidate scattered API keys and credentials into a secure .env file with proper permissions. Use when setting up OpenClaw, migrating credentials, auditing security, or enforcing the .env standard. This is not optional — centralized credential management is a core requirement for secure OpenClaw deployments. Scans for credential files across common locations, backs up existing files, creates a unified .env with mode 600, validates security, and enforces best practices.
---

# Credential Manager

• Confidence: 92% confidence
• Finding: This duplicate metadata finding still reflects real risk: the skill's core purpose is broad credential handling. The danger is amplified by its framing as mandatory and foundational, which may pressure users into running a high-privilege secret-management workflow without carefully evaluating whether centralized plaintext storage fits their environment.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: credential-manager
description: MANDATORY security foundation for OpenClaw. Consolidate scattered API keys and credentials into a secure .env file with proper permissions. Use when setting up OpenClaw, migrating credentials, auditing security, or enforcing the .env standard. This is not optional — centralized credential management is a core requirement for secure OpenClaw deployments. Scans for credential files across common locations, backs up existing files, creates a unified .env with mode 600, validates security, and enforces best practices.
---

# Credential Manager

• Confidence: 92% confidence
• Finding: This duplicate metadata finding still reflects real risk: the skill's core purpose is broad credential handling. The danger is amplified by its framing as mandatory and foundational, which may pressure users into running a high-privilege secret-management workflow without carefully evaluating whether centralized plaintext storage fits their environment.

Credential Access

High

• Category: Privilege Escalation

Content

# Add credential-manager scripts to path
sys.path.insert(0, str(Path.home() / '.openclaw/skills/credential-manager/scripts'))

# Enforce secure .env (exits if not compliant)
from enforce import require_secure_env, get_credential

require_secure_env()

• Confidence: 88% confidence
• Finding: The Python example instructs other skills to import helper code and retrieve credentials from the centralized secret store, which normalizes broad programmatic access to secrets across skills. This increases attack surface because any dependent skill gaining execution can potentially access the shared .env-derived credentials, turning one compromised skill into a multi-secret compromise.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
set -euo pipefail

# Validate .env exists and is secure
if ! python3 ~/.openclaw/skills/credential-manager/scripts/enforce.py; then
    exit 1
fi

• Confidence: 90% confidence
• Finding: The Bash example validates the shared .env and then sources it directly into the shell environment. Sourcing plaintext secrets into a shell widens exposure to subprocess inheritance, accidental debugging output, command-history mistakes, and shell parsing hazards if the file contents are malformed or attacker-influenced.

Credential Access

High

• Category: Privilege Escalation

Content

import os
from pathlib import Path

# Load .env
env_file = Path.home() / '.openclaw' / '.env'
with open(env_file) as f:
    for line in f:

• Confidence: 93% confidence
• Finding: The Python sample manually parses and loads every key from the centralized .env into process environment variables. This broad loading pattern exposes more secrets than necessary to the runtime and any child processes, and it lacks robust parsing or validation for edge cases such as quoting, multiline values, or hostile content.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path

# Load .env
env_file = Path.home() / '.openclaw' / '.env'
with open(env_file) as f:
    for line in f:
        if '=' in line and not line.strip().startswith('#'):

• Confidence: 93% confidence
• Finding: The code opens and iterates through the shared .env file directly, reinforcing a pattern of direct raw secret handling in application code. Direct parsing of a centralized plaintext secret file raises the likelihood of accidental disclosure, improper parsing, and overexposure of credentials to code paths that do not need them.

Credential Access

High

• Category: Privilege Escalation

Content

- Memory files with `-creds` or `credentials` in the name

**Sensitive Key Patterns:**
- API keys, access tokens, bearer tokens
- Secrets, passwords, passphrases
- OAuth consumer keys
- Private keys, signing keys, wallet keys

• Confidence: 94% confidence
• Finding: The skill advertises detection of highly sensitive material including access tokens, bearer tokens, passwords, private keys, wallet keys, and seed phrases. Handling such a broad and critical set of secret types materially elevates risk because compromise or mishandling could affect infrastructure accounts, cryptographic identities, and financial assets, not just routine API access.

Credential Access

High

• Category: Privilege Escalation

Content

print(f"\n📋 Found {len(results)} credential file(s) to migrate\n")
    
    # Backup existing .env
    if env_file.exists():
        backup_files([env_file], backup_dir)

• Confidence: 86% confidence
• Finding: The script backs up the existing ~/.openclaw/.env before loading it, but backup creation uses shutil.copy2 without enforcing restrictive permissions on the backup artifact. If the process umask or preexisting directory permissions are weak, secrets may be duplicated into backup locations with broader-than-intended accessibility, increasing credential exposure risk.

Credential Access

High

• Category: Privilege Escalation

Content

print(f"\n✅ Backup complete: {backup_dir}")
        return {'status': 'backup_only', 'backup_dir': str(backup_dir)}
    
    # Write .env
    print(f"\n✍️  Writing .env...")
    openclaw_dir.mkdir(parents=True, exist_ok=True)

• Confidence: 90% confidence
• Finding: The script writes secrets to ~/.openclaw/.env using a normal open(..., 'w') and only applies chmod 600 afterward. On many systems, the file is initially created with default umask-derived permissions, creating a transient window where newly written credentials could be more broadly readable than intended; additionally, there is no check for symlinks, enabling writes to an attacker-chosen target if the path is maliciously replaced.

Session Persistence

Medium

• Category: Rogue Agent

Content

## For Skill Developers

**DO NOT create .env files in your skill directories.**

Load credentials from root:

• Confidence: 91% confidence
• Finding: The guidance instructs developers to `source ~/.openclaw/.env`, which can import arbitrary shell content if the file is modified, malformed, or contains command substitutions rather than simple key-value pairs. It also promotes long-lived session-wide secret exposure by loading all credentials into the shell environment, increasing accidental leakage to child processes and debugging output.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.