A secure, zero-knowledge credential broker that enables AI agents to retrieve and safely hand off scoped Keeper credentials to service agents during multi-agent workflows.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install keeper-credentials
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install keeper-credentials using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Keeper Credential Broker?
The keeper-credentials skill transforms a user-facing AI agent into a secure, delegated credential broker. By leveraging the Keeper Secrets Manager (KSM) SDK, this tool allows the agent to interact with specifically shared folders inside the user's Keeper Vault without ever exposing the master password. It provides a robust architecture for executing authenticated actions across diverse services, offering a clean boundary between secret retrieval and multi-agent communication.
Integrating this tool with Openclaw Skills guarantees that sensitive credentials remain strictly controlled and isolated. Instead of relying on full-vault access or vulnerable hardcoded variables, this skill relies on scoped permissions and advanced delivery mechanisms like time-limited, single-use One-Time Share links to keep raw secrets entirely out of agent chat logs.
Keeper Credential Broker Use Cases
- Executing authenticated service calls on behalf of the user, such as booking an airline flight or retrieving an order status through external service agents.
- Authorizing agent-to-agent interactions securely without hardcoding API keys or exposing long-lived credentials in shared chat transcripts.
- Auditing and listing available credentials within scoped folders to let the user determine which logins the agent has permission to use.
How Keeper Credential Broker Works
- User Authorization: The user generates a one-time access token in their Keeper Web Vault for a designated Secrets Manager Application associated with specific shared folders.
- One-Time Bootstrap: The AI agent initializes using this token, generating a local, persistent configuration file (
ksm-config.json) containing cryptographic keys, which permanently invalidates the initial token. - Safe Listing & Checking: The agent uses local status and list commands to check connection validity and map available credential titles and field structures without fetching sensitive values.
- Secure Packaging: When an action requires authentication, the agent packages the credential using one of three delivery modes (One-Time Share, Notation Reference, or Inline) and gets a suggested payload.
- Safe Peer Delivery: The packaging output is passed through agent-to-agent protocols (such as Knoxville MCP) to hand off the secure credential or link directly to the recipient agent.
Keeper Credential Broker Setup
To configure this skill as part of your Openclaw Skills suite, ensure you have python3 and the required Keeper SDKs installed. Use the following steps:
1. Installation
Install the required dependencies:
uv pip install 'keeper-secrets-manager-core>=16.6.0'
# Optional: Required if you plan to use One-Time Share links via Keeper Commander
uv pip install 'keepercommander>=16.11.0'
2. Environment Configuration
Ensure the directory for storing the credentials config is set to a persistent volume so future sessions require zero manual authentication:
export KEEPER_SKILL_HOME='$HOME/.config/keeper-credentials'
3. Initialize the Connection
Using the one-time token (US:BASE64...) generated in your Keeper Web Vault, bootstrap the device config:
KEEPER_KSM_TOKEN='YOUR_KSM_TOKEN_HERE' python3 scripts/keeper_creds.py init
This exchanges the token for a local ksm-config.json file stored securely under $KEEPER_SKILL_HOME.
Keeper Credential Broker Data Schema & Taxonomy
This skill securely organizes its local files and metadata to preserve zero-knowledge principles. The directory structures and configurations are outlined below:
Config Directory & Files
| File Path | Description | Permissions | Sensitivity |
|---|---|---|---|
$KEEPER_SKILL_HOME/ksm-config.json |
Contains client ID, private EC key, and app key generated by KSM. | 0600 (Owner Read/Write only) |
High |
scripts/keeper_creds.py |
Core execution script that interfaces with KSM Core and Keeper Commander SDKs. | Executable | Medium (Logic only) |
Credential Discovery Schema
The list command returns structured metadata about available credentials without leaking the secret fields:
- UID: Unique Keeper record identifier.
- Title: User-facing credential label (e.g., 'Acme Airline').
- Type: Keeper record type category.
- Field Names: A schema list mapping existing custom fields, file names, or default text elements (e.g.,
login,password), excluding the actual field values.
Keeper Credential Broker Advanced Features
- Multiple Delivery Modes: Offers highly granular control over secret sharing, allowing developers to choose between dynamic One-Time Share links, secure Keeper Notation references, or inline raw delivery.
- Zero-Knowledge Architecture: Built natively on the Keeper Secrets Manager SDK to ensure client-side AES-256-GCM encryption, ensuring the host platform never has access to the master vault credentials.
- Session Persistence: Built-in support for persistent mounted volumes via
KEEPER_SKILL_HOME, eliminating the need to re-authenticate or re-bootstrap across ephemeral agent sessions. - Commander Integration: Seamless bridge to Keeper Commander for generating secure, self-destructing, and single-use One-Time Share (OTS) links directly from standard agent instructions.
SKILL.md
Loading
Related Openclaw Skills
Tencent Cloud SMS Skill for AI Agents
Enable your AI agent to automate domestic and international SMS alerts, track delivery statuses, and manage approved templates with this Tencent Cloud integration.
iFLYTEK Speed Transcription
An ultra-fast speech transcription skill that converts up to 5 hours of audio into high-accuracy text in seconds, supporting multiple languages and dialects.
iFlytek Machine Translation Skill
A zero-dependency Python skill using iFlytek's Machine Translation API to deliver highly accurate translations across more than 70 language pairs.
iFlytek Chinese Text Proofreader
A zero-dependency Python tool integrating iFlytek's Official Document Proofreading API to detect and correct 27 types of errors in Chinese text.
Feishu (Lark) Automation
An AI-driven automation skill to streamline daily Feishu tasks, from automated messages and reports to multidimensional tables and approvals.
Zhihu Content Strategist
An AI-powered content strategist tool to analyze Zhihu hot topics, identify high-opportunity content gaps, and generate high-engagement answer drafts.
Featured*
