A secure security utility designed to inventory, analyze the age of, and provide rotation workflows for API keys and environment secrets.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install secret-rotator
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install secret-rotator using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Secret Rotator?
Secret Rotator is a critical security skill for developers looking to automate the management of their digital credentials. By leveraging Openclaw Skills, this tool performs non-destructive scans of your local file system to identify .env files, SSH configs, and application tokens. It focuses on the metadata of your secrets—such as their age and storage location—rather than the sensitive values themselves.
This skill serves as a security auditor that enforces rotation policies, helping you mitigate the risk of long-lived credentials. It provides a structured lifecycle for secrets, moving from discovery to age analysis and finally to guided remediation, ensuring that your local and cloud environments remain compliant with modern security best practices.
Secret Rotator Use Cases
- Periodic auditing of local development directories to find forgotten or stale API keys.
- Identifying security risks where secrets are stored in files with insecure permissions.
- Managing the rotation of service tokens for OpenAI, AWS, or Stripe using standardized Openclaw Skills workflows.
- Verifying that sensitive configuration files are correctly excluded from version control via .gitignore.
- Troubleshooting environment variable issues across multiple project symlinks.
How Secret Rotator Works
- Discovery: The agent requests directory permissions to scan for common configuration patterns like .env, .config, and .ssh files.
- Inventory Management: It extracts key names and modification dates without ever displaying or logging the actual secret values.
- Aging Analysis: The skill compares the secret's last modified date against a security policy (e.g., 90-day rotation) to assign a health status.
- Remediation Planning: For overdue secrets, it provides the specific dashboard URLs for the associated services to facilitate manual rotation.
- Post-Rotation Validation: It assists in testing the new keys via health endpoints and updates file permissions to chmod 600 for maximum security.
Secret Rotator Setup
To begin using this skill within your environment, ensure your agent has file system access to your project directories. No external API keys are required to run this tool. Use the following commands to manually verify your secret landscape:
# Find .env files in your projects directory
find ~/projects -maxdepth 3 -name ".env*" -type f
# Audit file permissions for sensitive configs
ls -la ~/.config/*/config* ~/.ssh/config
Secret Rotator Data Schema & Taxonomy
The skill organizes secret metadata into a structured reporting format to ensure clarity without compromising security:
| Attribute | Description |
|---|---|
| File Path | The absolute or relative path to the configuration file. |
| Key Name | The identifier of the secret (e.g., STRIPE_SECRET_KEY). |
| Age | Numeric value in days since the file was last updated. |
| Status | Color-coded health indicator (OK, Rotate Soon, Overdue). |
| Masked Value | A safety-first representation showing only the last 4 characters. |
Secret Rotator Advanced Features
- Symlink Resolution: Automatically follows and reports the real path of symlinked environment files.
- Docker Secret Integration: Ability to audit secrets managed within Docker environments using native CLI commands.
- Cross-Project Impact Analysis: Identifies shared secrets that exist in multiple locations, ensuring synchronized updates.
- Git Leak Prevention: Proactively checks for the existence of .gitignore entries for every discovered secret file.
- Custom Rotation Policies: Configurable age thresholds to match specific organizational security requirements within Openclaw Skills.
SKILL.md
Loading
Related Openclaw Skills
Rey Screenshot
An autonomous screenshot and visual capture engine designed for AI agents to create documentation and social media content effortlessly.
Screen Recorder
A powerful CLI-based screen recording utility for X11 and Wayland environments powered by ffmpeg.
SaaS Builder
A comprehensive framework for planning, developing, and launching Micro-SaaS products focused on niche markets and recurring revenue.
Root Cause Tracing
A comprehensive diagnostic skill utilizing 5 Whys, fault tree analysis, and dependency tracing to find the true origin of system issues.
Security Review
A comprehensive security auditing extension that scans code, configurations, and AI operations for vulnerabilities and logic flaws.
AI Self-Identity Management
A framework for managing an AI agent's evolving personality and core values through exclusive human-led supervision.
Featured*
