A foundational security framework for managing API keys and secrets within AI agent environments without exposing them to the LLM context.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install secret-safe
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install secret-safe using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Secret-Safe: Secure Credential Management?
Secret-Safe is a critical utility designed for developers and users of Openclaw Skills who need to handle sensitive data like API keys, tokens, and passwords. It addresses a significant security gap where agents might accidentally leak credentials into chat logs, LLM prompts, or file artifacts. By enforcing a strict policy where secrets only flow through system environment variables or secure subprocesses, this skill ensures that your sensitive information remains private.
The skill provides clear patterns for environment injection and integration with professional-grade secrets managers. It serves as both a runtime protector and an auditing tool, allowing users to verify that their custom agent workflows adhere to the highest security standards. This approach prevents exfiltration risks and ensures that your Openclaw Skills remain production-ready and secure.
Secret-Safe: Secure Credential Management Use Cases
- Authenticating agent skills with external services like GitHub, Stripe, or cloud providers without exposing keys.
- Auditing third-party or custom Openclaw Skills for potential security vulnerabilities and credential leaks.
- Setting up secure development environments where agents interact with private APIs.
- Integrating 1Password, Doppler, or macOS Keychain secrets into automated agent workflows.
How Secret-Safe: Secure Credential Management Works
- The skill utilizes frontmatter metadata to define required environment variables, preventing the skill from loading if the keys are missing.
- It leverages the native environment injection of Openclaw Skills to pass credentials directly to the shell process.
- During execution, it instructs the agent to use shell variables instead of hardcoded strings, keeping secrets out of the LLM reasoning and command history.
- For advanced setups, it uses shell wrapper scripts to fetch secrets from system keychains at the moment of execution.
- It applies a set of audit rules to evaluate other skills, flagging dangerous patterns like echoing keys or storing them in temporary files.
Secret-Safe: Secure Credential Management Setup
To implement this security pattern in your Openclaw Skills, configure your environment variables in your shell or configuration file:
export MY_SERVICE_API_KEY="your_secure_token"
Then, add the requirement to your skill frontmatter:
metadata:
openclaw:
requires:
env: ["MY_SERVICE_API_KEY"]
primaryEnv: "MY_SERVICE_API_KEY"
Secret-Safe: Secure Credential Management Data Schema & Taxonomy
Secret-Safe manages security metadata using the following taxonomy to ensure consistent handling across Openclaw Skills:
| Attribute | Description |
|---|---|
requires.env |
A list of mandatory environment variables that must be present for the skill to operate. |
primaryEnv |
The primary credential mapping used to link the skill to user configuration files. |
Pattern 1-3 |
Logical workflows for environment injection, manager integration, and user setup flows. |
Secret-Safe: Secure Credential Management Advanced Features
- Multi-Manager Integration: Native support for 1Password CLI, Doppler, HashiCorp Vault, and Bitwarden.
- Subprocess Isolation: Logic that ensures secrets are fetched and injected entirely outside the view of the LLM context.
- Security Audit Engine: A comprehensive checklist for reviewing SKILL.md files to identify critical leaks or high-risk instructions.
- Secure Setup Guidance: Pre-defined prompts that lead users through out-of-band credential configuration.
SKILL.md
Loading
Related Openclaw Skills
macOS Calendar Assistant
An intelligent macOS-native tool for managing Calendar.app via automated scripts, supporting screenshot-to-schedule extraction and idempotent event updates.
VirusTotal Threat Intelligence (vt-hash-intel)
A comprehensive security intelligence tool for identifying and analyzing malicious files, URLs, domains, and IP addresses via VirusTotal.
Market Report
A professional-grade crypto market analysis tool that aggregates real-time data from CoinMarketCap to provide actionable financial summaries.
Crypto Research
A professional-grade AI research skill that performs deep-dive due diligence and technical analysis on cryptocurrencies using real-time CoinMarketCap data.
The Daily Human
A social networking skill for AI agents to browse news, post commentary, and interact with other autonomous entities.
DeepSeek Chat
A cost-effective integration for the DeepSeek API providing general chat, coding, and advanced reasoning capabilities.
Featured*
