A secure local credential vault with OS keychain integration and encrypted storage designed for AI agent workflows.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install passwords
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install passwords using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Passwords Skill?
The Passwords Skill provides a robust framework for managing sensitive credentials locally, ensuring that AI agents can interact with protected resources without compromising security. By leveraging OS-native keychain services and high-performance encryption like Argon2id and ChaCha20-Poly1305, this skill creates a trusted environment for storing usernames, passwords, and TOTP secrets. It is a vital component for developers building secure automation using Openclaw Skills.
This skill prioritizes security by ensuring that credentials are never exposed in command-line arguments or process lists. Instead, it utilizes safe delivery methods like environment variables, stdin pipes, and secure IPC. With built-in session management and sensitivity-based access controls, it balances developer productivity with rigorous security standards.
Passwords Skill Use Cases
- Securely storing API keys and database credentials for agent-driven development workflows.
- Managing multi-factor authentication (MFA) codes through integrated TOTP support for automated logins.
- Granting agents temporary, session-based access to web services and internal platforms.
- Preventing credential leakage in logs by using secure memory handling and environment variable unsetting.
How Passwords Skill Works
- The user initializes the vault with a master password meeting strict entropy requirements (zxcvbn score ≥ 3).
- Credentials and policies are encrypted at rest in the ~/.vault/ directory using the age encryption tool.
- A secure 256-bit session token is generated and stored in the OS-native secure storage (macOS Keychain, Linux libsecret, or Windows Credential Manager).
- When an agent requests a credential, the skill performs registrable domain matching and checks HTTPS requirements.
- Access is granted based on the sensitivity level of the entry, requiring manual user confirmation for medium to critical items.
- Credential data is delivered to the target process using memory-safe pipes or temporary environment variables that are zeroed after use.
Passwords Skill Setup
To get started with this skill, ensure you have the age encryption tool installed on your system.
# Install age dependency
# macOS
brew install age
# Ubuntu/Debian
sudo apt install age
# Initialize the vault and setup master password
# Follow the prompts to generate your BIP39 recovery phrase
openclaw passwords init
Passwords Skill Data Schema & Taxonomy
The skill organizes its data within the ~/.vault/ directory using an encrypted architecture:
| File | Description |
|---|---|
vault.age |
Contains encrypted credential entries, access policies, and integrity hashes. |
state.age |
Stores encrypted session metadata and tracking for failed access attempts. |
Entry Structure:
id,username,password,url: Primary credential identification.sensitivity: Categorization (low, medium, high, critical) to determine agent access rules.totp_secret: Optional field for generating time-based one-time passwords.policy: Integrity-hashed rules defining auto-access levels and confirmation triggers.
Passwords Skill Advanced Features
- Automated sensitivity detection that suggests security levels based on URL patterns (e.g., financial services marked as critical).
- Secure BIP39 recovery system providing a 256-bit recovery key as a word list for physical storage.
- Progressive lockout delays and state-file encryption to mitigate brute-force and side-channel attacks.
- Unicode normalization (NFKC) and TR39 confusable character checks to prevent domain-spoofing attacks.
- Dedicated encrypted audit logs with a unique HKDF key for tracking weekly access patterns and anomalies.
SKILL.md
Loading
Related Openclaw Skills
Passkey
A comprehensive implementation guide for integrating secure, phishing-resistant WebAuthn passkeys while avoiding common security and compatibility traps.
Paris
A comprehensive AI-driven guide for navigating Paris as a visitor, resident, student, or tech professional.
Parenting AI Assistant
A sophisticated AI agent skill designed to provide evidence-based, age-appropriate parenting guidance while avoiding common advice pitfalls.
Pandas
A high-performance skill for analyzing, transforming, and cleaning Python DataFrames using efficient vectorized operations and professional best practices.
Pay
An intelligent financial management skill for optimizing payment methods, maximizing rewards, and securing transactions.
Payments
A comprehensive framework for integrating secure payment gateways, subscription billing, and checkout flows into modern applications.
Featured*
