Credential Vault

This skill largely does what it says (a local encrypted vault), but a few things don't add up or are risky: 1) the metadata lists VAULT_MASTER_PASSWORD as the primary credential but the CLI always prompts interactively — don't assume you can safely set your master password in an env var to automate unlocks; 2) the vault stores a raw session key to ~/.openclaw/vault/session without explicitly hardening that file — consider inspecting/modifying the code to chmod the session file to 0600 or avoid writing the session key to disk; 3) the docs include an example that stores the master password in plaintext for cron jobs — treat that as unsafe and prefer more secure automation (OS keyring, dedicated secrets manager, or short-lived service credentials for CI); 4) review the code yourself (or run tests in an isolated environment) before using it for high-value secrets. If you want to proceed, at minimum: audit and patch session-file permissions, remove/avoid examples that write plaintext master passwords, and consider adding support for secure non-interactive unlocking (e.g., OS keyring) rather than env vars or plaintext files.