Secrets Manager

Secure secrets store for OpenClaw agents. Store, retrieve, rotate, and audit secrets with encrypted storage. Inject secrets into commands safely. Zero external dependencies.

Stop hardcoding secrets. Start managing them securely.

The Problem

API keys, tokens, passwords — they end up in shell history, logs, or committed to git. No local secrets store means every agent session is a potential leak.

Secrets Manager fixes this with encrypted local storage and zero dependencies.

Quick Start

Store a secret

bash

node skills/secrets-manager/secrets-manager.js --store openai-key sk-abc123

Get a secret (masked by default)

bash

node skills/secrets-manager/secrets-manager.js --get openai-key
# Output: [secrets-manager] openai-key: sk-a****23

Get raw value (for injection)

bash

node skills/secrets-manager/secrets-manager.js --get --raw openai-key
# Output: sk-abc123

List all secrets

bash

node skills/secrets-manager/secrets-manager.js --list

Delete a secret

bash

node skills/secrets-manager/secrets-manager.js --delete old-key

Rotate a secret

bash

node skills/secrets-manager/secrets-manager.js --rotate openai-key
# Generates a new random value, archives old as retired

Rotate all secrets

bash

node skills/secrets-manager/secrets-manager.js --rotate --all
# Batch-rotate every stored secret

Audit for security issues

bash

# All findings
node skills/secrets-manager/secrets-manager.js --audit

# Only expired
node skills/secrets-manager/secrets-manager.js --audit --expired

# Only expiring soon
node skills/secrets-manager/secrets-manager.js --audit --stale

Inject secrets into a command

bash

node skills/secrets-manager/secrets-manager.js --inject "curl -H 'Authorization: Bearer {{openai-key}}' https://api.openai.com/v1/chat"

Replaces {{secret_name}} placeholders with actual values.

Audit for security issues

bash

node skills/secrets-manager/secrets-manager.js --audit

Checks for expired rotation, weak patterns, and short secrets.

Status overview

bash

node skills/secrets-manager/secrets-manager.js --status

Features

Encrypted Storage

• Base64-encoded secrets with per-secret random keys
• Stored in memory/secrets/secrets.json
• Default masked output prevents accidental exposure

Rotation Tracking

• 90-day default rotation cycle per secret
• Automatic expiration warnings
• One-command rotation with new random value generation

Audit System

• Detects expired secrets past rotation date
• Flags secrets approaching rotation deadline
• Identifies weak patterns (common prefixes, short length <8 chars)
• Reports rotation age for each secret

Command Injection

• {{secret_name}} placeholders replaced before execution
• Safe for use in shell scripts and automation
• Masked output confirms injection without exposing values

Configuration

Secrets stored in: memory/secrets/secrets.json

Override storage location:

bash

--dir /path/to/secrets

Agent Protocol

When handling secrets:

1. Never hardcode — always use --store first, then --get --raw
2. Masked output — use --get (not --get --raw) for display
3. Audit regularly — run --audit during heartbeats
4. Rotate proactively — rotate secrets flagged as expiring
5. Inject safely — use --inject for commands that need secrets

Security Notes

• Encryption is XOR + base64 (prevents accidental exposure, not military-grade)
• For production-grade encryption, integrate with a vault (HashiCorp, AWS Secrets Manager)
• Secrets directory should be gitignored
• Key rotation recommended every 90 days

Comparison

Approach	Security	Setup	Audit	Rotation
Environment vars	Medium	Medium	None	Manual
.env files	Low	Low	None	Manual
Secrets Manager	Good	None	Auto	Auto
Vault service	High	High	Auto	Auto

Secrets Manager gives you encrypted storage + rotation + auditing with zero external dependencies.

Design Principles

1. Zero setup — Works immediately, no config needed
2. No dependencies — Pure Node.js crypto, no npm packages
3. Safe by default — Masked output, rotation tracking
4. Transparent — Audit reports show exactly what's wrong
5. Injectable — {{placeholder}} syntax for command integration