Nex Keyring
v1.0.0Manage and track local API keys, secrets, and tokens with rotation status, risk levels, auditing, and policy enforcement without storing actual secret values.
⭐ 1· 53·0 current·0 all-time
byNex AI@nexaiguy
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description match the implementation: the package scans .env files and environment variables, detects service patterns, records metadata (name, prefix, SHA256 hashes if provided), tracks rotation history and audit logs, and stores everything under ~/.nex-keyring in SQLite. There are no unexpected cloud credentials or unrelated external services requested.
Instruction Scope
SKILL.md and the code direct the tool to read .env files and environment variables (intentional and expected). The implementation generally avoids storing actual secret values (it stores presence, prefixes and hashes), but scanning environment variables and files is inherently sensitive — ensure you understand the privacy implications and that the agent or the person running setup is trusted.
Install Mechanism
There is no remote install step or external download; installation is via the included setup.sh which writes files under the user's home (~/.nex-keyring) and creates a wrapper in ~/.local/bin. No network fetching or third‑party installers are invoked. Note: the setup script initially writes a wrapper with a hardcoded path then rewrites it to use SKILL_DIR; this looks odd but the final wrapper is created from the local skill directory.
Credentials
The skill declares no required environment variables or external credentials (consistent with purpose). README mentions optional env overrides (NEX_KEYRING_HOME, NEX_KEYRING_DB) not visible in the provided code — a small documentation/code mismatch. The code does inspect os.environ to detect keys (expected), but it does not appear to exfiltrate environment contents.
Persistence & Privilege
The skill does not request global/system privileges or 'always' inclusion. It stores files under the user's home and creates a user-level CLI wrapper (~/.local/bin). It does not modify other skills or system-wide configs beyond that user-level install.
Assessment
This package appears to do what it claims: locally scan .env files and environment variables, track key metadata and rotation history, and avoid storing actual secret values. Before installing or running setup.sh, consider: 1) Review the setup.sh wrapper path that is written — ensure it points to the skill files on your machine (it tries to locate SKILL_DIR but double-check). 2) The tool reads environment variables and .env files — only run it in contexts where you trust the host and operator, and avoid running on machines with untrusted processes. 3) There are small code/documentation inconsistencies (README mentions env overrides that aren't evident in the code) and at least one apparent coding bug (truncated/undefined variable in storage.list_secrets that may cause runtime errors). I recommend auditing the code locally (especially storage.list_secrets and any truncated sections), running setup.sh in a controlled environment or container, installing the cryptography package if you want Fernet encryption, and backing up any sensitive files before first run. If you want higher assurance, ask the author for a complete, non-truncated source and unit tests demonstrating behavior (or run it in an isolated VM/container).Like a lobster shell, security has layers — review code before you run it.
latestvk977sf85ynkz9npf90qdjkrck1849wby
License
MIT-0
Free to use, modify, and redistribute. No attribution required.