A security auditing tool designed to detect exposed credentials, improper file permissions, and git contamination within AI agent environments.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install credential-hygiene-validator
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install credential-hygiene-validator using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Credential Hygiene Validator?
The Credential Hygiene Validator is a specialized security utility built to maintain the integrity of sensitive information within your Openclaw Skills ecosystem. It systematically scans configuration files and dotfile directories to identify common security pitfalls, such as world-readable permissions or hardcoded API keys. By identifying these vulnerabilities before they lead to incidents, this tool ensures that your automated workflows remain secure and compliant with modern security standards.
This skill is essential for developers who manage multiple API integrations and want to ensure their environment follows the principle of least privilege. Whether you are checking for JWT exposure or verifying that your configuration isn't being tracked by version control, this validator provides a comprehensive safety net for your Openclaw Skills deployment.
Credential Hygiene Validator Use Cases
- Reviewing security posture after installing a new service or tool within your Openclaw Skills setup.
- Auditing dotfiles for leaked tokens before pushing updates to public repositories.
- Verifying that log files do not contain sensitive Bearer tokens or hex strings.
- Confirming that configuration directories are correctly excluded via .gitignore.
- Monitoring the age of tokens to enforce regular rotation policies.
How Credential Hygiene Validator Works
- The validator first checks file permissions on critical configuration paths, ensuring only the owner has read/write access.
- It performs a high-depth regex scan to detect plaintext tokens, including JWTs and RFC-compliant Bearer headers.
- The skill queries the local Git environment to verify that sensitive configuration directories are not part of a working tree.
- It cross-references file paths against the .gitignore file to ensure credential directories are properly masked.
- Finally, it analyzes file modification timestamps to alert the user if credentials have exceeded the recommended rotation period.
Credential Hygiene Validator Setup
To utilize this skill, ensure your environment has the necessary binaries installed: grep, stat, and git. Most Unix-based systems include these by default. No additional installation is required if you are already running Openclaw Skills.
# Verify dependencies are available
stat --version
grep --version
git --version
# Ensure your config directory is accessible
ls -d ~/.openclaw
Credential Hygiene Validator Data Schema & Taxonomy
The skill operates as a read-only validator and generates reports based on the existing file structure of your environment. It focuses on the following data points:
| Data Point | Target Path | Validation Logic |
|---|---|---|
| Permissions | ~/.openclaw/openclaw.json |
Checks for octal 600 or 700 |
| Plaintext Tokens | ~/.openclaw/ |
Regex match for hex, JWT, and Bearer strings |
| Git Exposure | Config directory | git rev-parse to detect repository root |
| Leakage | ~/.openclaw/logs/*.log |
Scans log output for sensitive token patterns |
| Rotation Status | Config files | Evaluates modification time vs 90-day threshold |
Credential Hygiene Validator Advanced Features
- RFC 6750 compliant pattern matching for accurate detection of Bearer tokens.
- Case-insensitive scanning for various authentication header formats.
- Atomic write safety verification by detecting the presence of backup configuration files.
- Alignment with T-ACCESS-003 of the OpenClaw threat model for standardized security compliance.
- Support for multi-agent environments where different Openclaw Skills may share configuration directories.
SKILL.md
Loading
Related Openclaw Skills
badass-revival
Register sovereign domains like .badass and .forever as ERC-721 NFTs on Ethereum mainnet using Impervious Domains contracts.
FB Repost Skill
An automated workflow to scrape Facebook posts, rewrite them with AI, generate custom visuals, and publish to Facebook Pages.
Google Docs from Markdown
A bridge utility that converts Markdown files into fully editable Google Docs by automating the DOCX conversion and Drive upload workflow.
AnyCrawl Skill
A comprehensive web data extraction tool for OpenClaw that enables multi-threaded crawling, search engine integration, and structured scraping.
Rate Limit Validator
A diagnostic tool for testing if HTTP endpoints correctly enforce rate limiting and provide standard throttling headers.
Clawbox Media Server
A lightweight, bidirectional LAN file sharing solution that allows AI agents and users to exchange files over a local network without internet access.
Featured*
