A security auditing utility that scans Openclaw configuration files to identify and privatize plaintext secrets via environment variables.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install token-safety-checker
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install token-safety-checker using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Token Safety Checker?
The Token Safety Checker is a dedicated security tool designed to protect your sensitive data within the Openclaw Skills ecosystem. It focuses on auditing the openclaw.json configuration file to identify plaintext secrets such as API keys, tokens, and passwords that could lead to unauthorized access if exposed. By migrating these values into secure environment variables using the SecretRef format, it ensures your credentials remain private.
This skill is built with a security-first mindset, running all operations locally. It is designed to prevent sensitive values from ever appearing in command-line arguments, log files, or agent contexts, making it an essential utility for developers who prioritize security when using Openclaw Skills.
Token Safety Checker Use Cases
- Scanning openclaw.json for plaintext secrets after manual configuration updates.
- Privatizing API tokens and passwords during the initial setup of a new instance.
- Automating the migration of credentials to environment variables to meet security compliance.
- Auditing configuration files to ensure no sensitive data is leaked into the agent context.
How Token Safety Checker Works
- The utility executes a local scan of the openclaw.json file to detect any values stored in plaintext.
- It generates a findings report that includes metadata like the configuration path and secret length, ensuring no actual secret values are revealed.
- The user reviews the detected paths and confirms the proposed environment variable names.
- A dry-run migration is performed to simulate the changes and verify the shell profile updates.
- Upon confirmation, the skill backs up the configuration, updates the shell profile with masked exports, and replaces plaintext values with SecretRef pointers.
- The user restarts the gateway to load the newly secured environment variables.
Token Safety Checker Setup
To get started with this security tool for Openclaw Skills, ensure Python 3 is installed on your system.
# Navigate to the skill directory
cd token-safety-checker
# Run a scan to find plaintext secrets
python3 scripts/safeclaw.py scan --config ~/.openclaw/openclaw.json
Token Safety Checker Data Schema & Taxonomy
The skill manages secret migration using a structured findings format and the SecretRef taxonomy within the Openclaw Skills environment.
| Component | Format / Description |
|---|---|
| Findings JSON | Includes path, env_var, and length (e.g., {"path": "channels.discord.token", "env_var": "OPENCLAW_DISCORD_TOKEN", "length": 72}) |
| SecretRef (Env) | { "source": "env", "provider": "default", "id": "VAR_NAME" } |
| SecretRef (File) | { "source": "file", "provider": "default", "id": "/path/to/secret.txt" } |
| Backup | Automatically creates openclaw.json.bak before any write operations |
Token Safety Checker Advanced Features
- Local-only execution ensures secret values never leave your machine or appear in logs.
- Support for multiple SecretRef sources including environment variables, external files, and executable commands.
- Integrated rollback system using the --restore flag to quickly revert configuration changes.
- Intelligent shell profile detection for zsh, bash, and other common environments.
- Automated validation that re-scans the configuration before migration to prevent race conditions.
SKILL.md
Loading
Related Openclaw Skills
AI Travel Skill Package
A comprehensive AI-powered travel assistant for itinerary planning, budgeting, visa guidance, and smart packing.
Windows UI Controller
A specialized skill enabling AI agents to control Windows applications through UI element scanning, clicking, and text input.
AI Travel Skill Package
A comprehensive AI-driven travel suite providing end-to-end services from intelligent itinerary generation to visa and packing assistance.
AI Intelligent Travel Assistant Suite
A comprehensive AI travel assistant suite providing one-stop services for itinerary planning, destination guides, budget management, and visa assistance.
Trojan Setup Skill
Automates the installation and configuration of the Trojan proxy client and proxychains4 on Linux systems for secure network access.
Word Document Creator Skill
An industrial-grade Word document generator that combines Word COM automation with python-docx for robust and reliable file creation.
Featured*
