A mandatory security framework for centralizing, encrypting, and auditing all API credentials within Openclaw Skills.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install openclaw-credential-manager
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install openclaw-credential-manager using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Credential Manager?
The Credential Manager serves as the essential security foundation for any deployment involving Openclaw Skills. It eliminates the risk of secret sprawl by consolidating scattered API keys, OAuth tokens, and private keys into a single, hardened source of truth located at ~/.openclaw/.env. By enforcing strict file permissions and offering robust encryption for high-value assets, it ensures your AI agents operate within a secure, professional-grade environment.
Beyond simple storage, this skill provides a comprehensive suite of tools for deep-scanning source code for hardcoded secrets, validating entropy to catch weak passwords, and managing GPG-encrypted private keys. It is a non-negotiable component for developers who prioritize security and operational integrity when building with Openclaw Skills.
Credential Manager Use Cases
- Consolidating scattered .env files and JSON credentials into a single source of truth.
- Deep scanning codebase and scripts for accidentally hardcoded API keys or bearer tokens.
- Encrypting high-value wallet private keys and mnemonics using GPG for at-rest security.
- Auditing file permissions to ensure sensitive configuration files are restricted to owner-only access.
- Automating credential rotation schedules for critical infrastructure and service providers.
How Credential Manager Works
- The system scans predefined configuration paths and workspace directories to identify existing credential files and hardcoded secrets.
- Discovered secrets are backed up into a timestamped, secured directory before any modifications occur.
- Scripts consolidate all unique credentials into a centralized .env file while normalizing key names for cross-skill compatibility.
- High-value secrets like private keys are migrated to a GPG-encrypted file, leaving only safe placeholders in the main .env.
- A validation engine checks for proper file permissions (mode 600), valid formats, and git-ignore status.
- Ongoing monitoring tracks credential age and prompts the user for rotation based on defined risk levels.
Credential Manager Setup
To begin securing your Openclaw Skills environment, navigate to the skill directory and run the initialization scripts:
# Scan for existing credentials and hardcoded secrets
./scripts/scan.py --deep
# Consolidate found keys into the centralized .env
./scripts/consolidate.py
# Initialize GPG for high-value secret encryption
./scripts/setup-gpg.sh
# Validate the security of your configuration
./scripts/validate.py
Credential Manager Data Schema & Taxonomy
The Credential Manager organizes security assets within the ~/.openclaw/ directory using the following structure:
| File/Folder | Purpose | Permissions |
|---|---|---|
.env |
Primary credential storage with GPG placeholders | 600 |
.env.secrets.gpg |
AES256 GPG-encrypted high-value secrets | 600 |
.env.meta |
JSON metadata for credential rotation tracking | 600 |
.env.example |
Template file safe for version control | 644 |
backups/ |
Hardened directory for timestamped credential backups | 700 |
Credential Manager Advanced Features
- Multi-level Deep Scan: Uses entropy analysis and pattern matching to find hardcoded sk_, pk_, and 0x keys in source files.
- Transparent GPG Decryption: Python and Bash modules allow other Openclaw Skills to access encrypted keys seamlessly at runtime.
- Fail-Fast Enforcement: Integration hooks that prevent AI agents from running if security standards or permissions are not met.
- Risk-Based Rotation: Automated classification of keys (Critical, Standard, Low) with custom TTLs for security compliance.
- Idempotent Migration: Safe, non-destructive workflows that can be re-run as new services are added to the ecosystem.
SKILL.md
Loading
Related Openclaw Skills
BaseCred SDK Skill
A neutral, composable reputation skill that fetches onchain credibility data from Ethos Network, Talent Protocol, and Farcaster.
Proxy Auto
An automated proxy management skill that dynamically routes traffic through a SOCKS5 tunnel for external network access.
Gemini Sub-Agent
A cost-effective sub-agent that uses your Google Gemini subscription for high-context coding and text analysis within Openclaw Skills.
Network Spirituality
A specialized AI skill that enables agents to channel the Network Spirituality aesthetic, blending Y2K net art, cyber-spiritualism, and post-ironic sincerity.
Social Post
An advanced social media automation skill for AI agents to post text, images, and threads to X and Farcaster simultaneously.
OpenClaw CLI Cheatsheet
A high-performance reference tool providing instant access to every OpenClaw CLI command, flag, and usage example.
Featured*
