Keychain Bridge Publish

• Outcome: Review
• Latest audit: May 28, 2026 · 1:57 AM UTC
• Version: 1.1.0

Overview

This skill is local and purpose-aligned, but it handles high-value secrets and includes under-scoped workflows that can recreate plaintext credentials on disk.

Review before installing. Use it only on macOS accounts where you are comfortable giving the agent access to Keychain and ~/.openclaw/secrets. Run migrations with --dry-run first, avoid broad read/get-secret requests, review the hard-coded Group B service list, and avoid populate_secrets.sh unless those bash tools truly require plaintext files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        with open(val_path, 'w') as vf:
            vf.write(value)
        result = subprocess.run(
            [python_path, script_path],
            capture_output=True, text=True, timeout=30
        )

• Confidence: 91% confidence
• Finding: The script executes every discovered Python binary, including interpreters found under ~/.pyenv/versions, and passes them a generated script containing access to plaintext secrets. If an attacker can place or modify a fake or trojaned Python interpreter in those searched locations, the secrets can be exfiltrated when migration runs. In a secret-management skill, that context makes this substantially more dangerous because high-value credentials are handled intentionally.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The helper advertises Keychain-backed secret handling but silently falls back to reading plaintext files from ~/.openclaw/secrets when keyring access fails. This weakens the security boundary users would reasonably expect, can reintroduce plaintext secret exposure on disk, and masks configuration or permission failures that should be surfaced explicitly.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The README advertises very broad natural-language trigger phrases such as "Migrate my secrets to keychain" and "Audit my secrets directory for plaintext leaks" without any stated confirmation, scope limits, or safety checks. In a secrets-management skill, broad activation increases the chance an agent will perform credential-moving or filesystem-scanning actions automatically from casual user text, which can lead to unintended secret exposure or destructive migration steps.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The top-level description says to use the skill for broad topics like 'credentials', 'API keys', and generic 'security hardening on macOS,' which can cause the agent to invoke it for loosely related requests. For a skill that can read/write secrets and create bridge files, over-broad routing increases the chance of unintended secret access or modification.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Several trigger phrases are generic, including 'move secrets', 'audit secrets', 'read secret', 'get API key', and 'store secret'. In context, these phrases can capture ordinary support requests and route them into a skill capable of credential retrieval and persistence, creating an unnecessary exposure path.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script retrieves a secret and writes it directly to stdout, which can expose sensitive data through shell history, terminal scrollback, logging pipelines, parent process capture, or accidental redirection to files. In this skill's context, the tool is explicitly designed to bridge secrets into bash workflows, which increases the chance that secrets are propagated into less controlled environments.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: Secret retrieval and the fallback to file-based secrets occur without any warning, logging, or disclosure to the caller. This can cause operators to believe secrets are protected in Keychain when they are actually being read from disk, delaying detection of insecure storage and troubleshooting of broken Keychain access.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script retrieves secrets from the macOS Keychain and writes them into plaintext files on disk, increasing exposure compared with keeping them only in the Keychain. Even with mode 600, secrets may be read by the owning user, copied by backups, leaked through later misconfiguration, or left behind longer than intended, and the script gives no explicit warning or consent prompt before materializing them.

Credential Access

High

• Category: Privilege Escalation

Content

- **Auto-detection** of all Python versions on the system with full ACL coverage
- **Group A/B architecture** for mixed Python/bash environments
- **Plaintext leak auditor** that catches forgotten secret files
- **Diagnostic tools** for every known Tahoe keychain failure mode
- **Boot-time file bridge** for bash scripts that can't use keychain directly

## What You Get

• Confidence: 87% confidence
• Finding: The README explicitly advertises a "Boot-time file bridge" for bash scripts that cannot use keychain directly, which implies copying secrets out of Keychain back into plaintext files at startup. Re-materializing secrets into files weakens the stated security model and can expose credentials to local processes, backups, crash reports, or misconfigured permissions.

Credential Access

High

• Category: Privilege Escalation

Content

- **Group A/B architecture** for mixed Python/bash environments
- **Plaintext leak auditor** that catches forgotten secret files
- **Diagnostic tools** for every known Tahoe keychain failure mode
- **Boot-time file bridge** for bash scripts that can't use keychain directly

## What You Get

• Confidence: 87% confidence
• Finding: The mention of a boot-time file bridge for tools that cannot use keychain directly confirms a design that intentionally writes secrets out to files. In a secrets-management context, that creates a real downgrade path that an attacker or other local process may exploit if permissions, lifecycle, or storage locations are not tightly controlled.

Credential Access

High

• Category: Privilege Escalation

Content

| `SKILL.md` | Full agent instructions — your OpenClaw agent knows how to use everything |
| `scripts/migrate_secrets.py` | Batch migration with multi-Python ACL injection and verification |
| `scripts/audit_secrets.py` | Continuous plaintext leak detection and keychain health checks |
| `scripts/keychain_helper.py` | Drop-in Python module — replaces file reads with keychain lookups |
| `scripts/populate_secrets.sh` | Boot-time bridge that populates files from keychain for bash tools |
| `scripts/get_secret.py` | CLI wrapper for interactive/terminal use |

• Confidence: 88% confidence
• Finding: Describing `populate_secrets.sh` as a boot-time bridge that populates files from keychain for bash tools indicates intentional export of secrets from Keychain into filesystem artifacts. That is a genuine security concern because it expands the attack surface from protected keychain items to plaintext files accessible to local malware, operators, or misconfigured jobs.

Credential Access

High

• Category: Privilege Escalation

Content

| `SKILL.md` | Full agent instructions — your OpenClaw agent knows how to use everything |
| `scripts/migrate_secrets.py` | Batch migration with multi-Python ACL injection and verification |
| `scripts/audit_secrets.py` | Continuous plaintext leak detection and keychain health checks |
| `scripts/keychain_helper.py` | Drop-in Python module — replaces file reads with keychain lookups |
| `scripts/populate_secrets.sh` | Boot-time bridge that populates files from keychain for bash tools |
| `scripts/get_secret.py` | CLI wrapper for interactive/terminal use |

• Confidence: 88% confidence
• Finding: Describing `populate_secrets.sh` as a boot-time bridge that populates files from keychain for bash tools indicates intentional export of secrets from Keychain into filesystem artifacts. That is a genuine security concern because it expands the attack surface from protected keychain items to plaintext files accessible to local malware, operators, or misconfigured jobs.

Credential Access

High

• Category: Privilege Escalation

Content

2. **Per-binary Keychain ACL** — each Python binary needs its own ACL entry;
   migration tool handles this automatically
3. **Group A/B secret architecture** — a practical pattern for mixed Python/bash
   environments where Group A uses keychain directly and Group B uses boot-time
   file bridges
4. **Security CLI regression on Tahoe** — `security find-generic-password -w`
   hangs even after `security unlock-keychain` with the correct password

• Confidence: 86% confidence
• Finding: The documented "Group A/B secret architecture" explicitly includes a mode where some environments use boot-time file bridges rather than direct keychain access. This institutionalizes a plaintext-secret fallback path, making the overall design more dangerous because sensitive data may persist outside the Keychain boundary.

Credential Access

High

• Category: Privilege Escalation

Content

After installing the skill, just tell your OpenClaw agent:

> "Migrate my secrets to keychain"

or

• Confidence: 91% confidence
• Finding: The quick-start instruction "Migrate my secrets to keychain" is a broad natural-language trigger for a sensitive operation involving discovery, reading, and relocating credentials. Without stated scoping, dry-run behavior, or confirmation, an agent may initiate high-impact secret-handling actions too easily.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.