Security audit
Security checks across malware telemetry and agentic risk
This skill has a legitimate security purpose, but it asks for broad access to sensitive credentials and can persist, copy, modify, and delete secret-bearing files with under-scoped safeguards.
Install only if you intentionally want this skill to inspect and migrate credential files. Run scan-only first, review every path, avoid --yes for real migrations, verify ~/.openclaw/.env and backups before cleanup, do not consolidate wallet seed phrases or private keys unless you have a strong reason, and avoid sourcing or printing secrets in shell sessions.
# Interactive mode (prompts before changes) ./scripts/consolidate.py # Auto-confirm (no prompts) ./scripts/consolidate.py --yes # Backup only
The skill automatically detects credentials by scanning for: **File Patterns:** - `credentials.json` files in config directories - `.env` files - Memory files with `-creds` or `credentials` in the name
--- name: credential-manager description: MANDATORY security foundation for OpenClaw. Consolidate scattered API keys and credentials into a secure .env file with proper permissions. Use when setting up OpenClaw, migrating credentials, auditing security, or enforcing the .env standard. This is not optional — centralized credential management is a core requirement for secure OpenClaw deployments. Scans for credential files across common locations, backs up existing files, creates a unified .env with mode 600, validates security, and enforces best practices. --- # Credential Manager
--- name: credential-manager description: MANDATORY security foundation for OpenClaw. Consolidate scattered API keys and credentials into a secure .env file with proper permissions. Use when setting up OpenClaw, migrating credentials, auditing security, or enforcing the .env standard. This is not optional — centralized credential management is a core requirement for secure OpenClaw deployments. Scans for credential files across common locations, backs up existing files, creates a unified .env with mode 600, validates security, and enforces best practices. --- # Credential Manager
--- name: credential-manager description: MANDATORY security foundation for OpenClaw. Consolidate scattered API keys and credentials into a secure .env file with proper permissions. Use when setting up OpenClaw, migrating credentials, auditing security, or enforcing the .env standard. This is not optional — centralized credential management is a core requirement for secure OpenClaw deployments. Scans for credential files across common locations, backs up existing files, creates a unified .env with mode 600, validates security, and enforces best practices. --- # Credential Manager
# Add credential-manager scripts to path sys.path.insert(0, str(Path.home() / '.openclaw/skills/credential-manager/scripts')) # Enforce secure .env (exits if not compliant) from enforce import require_secure_env, get_credential require_secure_env()
#!/usr/bin/env bash
set -euo pipefail
# Validate .env exists and is secure
if ! python3 ~/.openclaw/skills/credential-manager/scripts/enforce.py; then
exit 1
fiimport os
from pathlib import Path
# Load .env
env_file = Path.home() / '.openclaw' / '.env'
with open(env_file) as f:
for line in f:from pathlib import Path
# Load .env
env_file = Path.home() / '.openclaw' / '.env'
with open(env_file) as f:
for line in f:
if '=' in line and not line.strip().startswith('#'):- Memory files with `-creds` or `credentials` in the name **Sensitive Key Patterns:** - API keys, access tokens, bearer tokens - Secrets, passwords, passphrases - OAuth consumer keys - Private keys, signing keys, wallet keys
print(f"\n📋 Found {len(results)} credential file(s) to migrate\n")
# Backup existing .env
if env_file.exists():
backup_files([env_file], backup_dir)print(f"\n✅ Backup complete: {backup_dir}")
return {'status': 'backup_only', 'backup_dir': str(backup_dir)}
# Write .env
print(f"\n✍️ Writing .env...")
openclaw_dir.mkdir(parents=True, exist_ok=True)## For Skill Developers **DO NOT create .env files in your skill directories.** Load credentials from root:
64/64 vendors flagged this skill as clean.
No suspicious patterns detected.