Locker Vault is a secure credential and secrets management skill for OpenClaw agents that utilizes the Locker Secrets Manager with high-performance in-memory caching.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install locker-vault
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install locker-vault using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Locker Vault?
Locker Vault provides a robust framework for Openclaw Skills to handle sensitive data without the risk of leakage. By establishing a single source of truth, this skill ensures that all credentials—including API keys, tokens, and database strings—are stored in Locker's encrypted vault and accessed through a cached client. This architecture eliminates the need for insecure .env files and prevents secrets from ever appearing in logs or chat responses.
The skill is built on the principle of vault-reference patterns, where agents store a reference like vault://SECRET_KEY instead of the actual value. A built-in cache layer with configurable Time-To-Live (TTL) ensures that repeated access to the same credential remains high-performance, reducing latency by avoiding redundant CLI calls and network round-trips.
Locker Vault Use Cases
- Accessing third-party API keys and tokens during agent execution sessions.
- Securing database credentials and connection strings for backend automation.
- Creating cron jobs or scheduled tasks that require authenticated access without hardcoding secrets.
- Managing credential rotation and updates across multiple Openclaw Skills simultaneously.
- Implementing strict read-only access for customer-facing bots to prevent unauthorized secret creation.
How Locker Vault Works
- The agent requests a secret using the vault-client wrapper.
- The client checks the internal in-memory cache for an existing, unexpired value.
- If a cache miss occurs, the Permission Gate verifies if the agent's mode (RO/RW) allows the requested operation.
- The client executes a secure subprocess call to the Locker CLI to retrieve or update the secret.
- The value is returned to the agent and stored in the cache for future requests, while ensuring the actual value never persists in the agent's logs.
Locker Vault Setup
1. Install Locker CLI
curl -fsSL https://locker.io/secrets/install.sh | bash
locker --version
2. Authenticate CLI
Set your access keys as environment variables for the initial bootstrap:
export LOCKER_ACCESS_KEY_ID="your-access-key-id"
export LOCKER_SECRET_ACCESS_KEY="your-secret-access-key"
3. Initialize the Client
Copy vault-client.js to your workspace and initialize within your script:
const vault = require('./vault-client');
await vault.init({ mode: 'ro', cacheTTL: 300 });
Locker Vault Data Schema & Taxonomy
Locker Vault organizes data using a key-value mapping within the Locker Cloud API. Openclaw Skills interact with this data using the following schema:
| Attribute | Description | Format |
|---|---|---|
| Secret Key | Unique identifier for the credential | String (e.g., OPENAI_API_KEY) |
| Secret Value | The encrypted sensitive data | String (Encrypted at rest) |
| Reference | The pointer used in configuration files | vault://KEY_NAME |
| Cache Object | In-memory storage for performance | Map<key, {val, expiry}> |
| Permission Mode | Defines agent access level | 'ro' (Read-Only) or 'rw' (Read-Write) |
Locker Vault Advanced Features
- TTL Override: Set custom expiration times for specific keys that rarely change.
- Reference Resolver: Automatically recursively replace vault:// tags in complex JSON configuration objects.
- Cache Statistics: Monitor hit rates and latency improvements with built-in cache-stats reporting.
- Permission Gating: Hard-coded enforcement of read/write boundaries independent of the external CLI permissions.
- Secure Random Generation: Programmatically create and store cryptographically secure random secrets for new integrations.
SKILL.md
Loading
Related Openclaw Skills
Pilot Audit Log
A comprehensive audit trail system for Pilot Protocol designed to capture and manage security-critical events for compliance.
pilot-archive
A comprehensive indexing and search engine for historical communications and file transfers conducted over Pilot Protocol.
Pilot Auction
A decentralized task auction system that enables agents to bid on work based on price, speed, and quality guarantees.
Pilot Auto-Trust
Pilot Auto-Trust automates handshake approvals and trust lifecycle management for Pilot Protocol agents using customizable logic and policies.
Whataburger Information Station
A specialized information hub providing deep insights into Whataburger's history, products, and global market presence.
Panda Express Knowledge Card
A structured information retrieval skill that provides a concise business and industry knowledge card for Panda Express.
Featured*
