A lightweight Hashicorp Vault client that enables AI agents to manage secrets securely without external dependencies or hardcoded credentials.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install vault-client
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install vault-client using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Vault Client for Hashicorp?
The vault-client is a robust integration designed for Openclaw Skills that facilitates secure communication with Hashicorp Vault servers. It eliminates the need for risky practices such as hardcoding tokens in transcripts or using complex curl commands. By providing a clean, cached interface, it allows agents to interact with secrets like API keys and database credentials through a standardized workflow.
This skill is built for developers who require a production-grade secret management solution within their AI-driven environments. It focuses on security, ease of use, and performance by leveraging a local cache to minimize API calls while ensuring tokens remain valid and secrets are updated correctly without overwriting existing data structures.
Vault Client for Hashicorp Use Cases
- Automating the retrieval of database credentials or API keys during agent-led development tasks.
- Implementing dynamic secret rotation and updates within automated workflows.
- Monitoring Vault token health and performing automated renewals to prevent session interruptions.
- Centralizing secret management across multiple AI agents using a unified configuration.
How Vault Client for Hashicorp Works
- The user initializes the skill by running a setup script that captures the Vault address, mount point, and authentication details.
- Configuration is stored locally in a secure JSON file, while a startup block is added to the agent's environment to ensure the client is ready for use.
- Upon every session start, a check command verifies the connection and token validity, returning specific exit codes to signal the agent regarding token expiration or connectivity issues.
- When a secret is requested, the client first checks a local cache to provide low-latency access; if the cache is expired, it fetches the latest data from the Vault server.
- Write operations use a merge strategy, ensuring that new keys are added to existing secret paths without deleting current information.
Vault Client for Hashicorp Setup
To get started with this vault integration for Openclaw Skills, run the setup script to configure your environment:
node ~/.openclaw/workspace/skills/vault-client/scripts/vault.js setup
This will prompt you for your Vault address, token, and mount point. Once configured, you can verify your connection and token status at any time using:
node ~/.openclaw/workspace/skills/vault-client/scripts/vault.js check
Vault Client for Hashicorp Data Schema & Taxonomy
The skill organizes its configuration and temporary data within the ~/.openclaw/ directory using two primary JSON files:
| File | Description |
|---|---|
vault.json |
Contains the primary configuration: server address, mount path, authentication methods, and TLS settings. |
vault-cache.json |
Stores cached secrets to reduce API load, respecting the cache_ttl_seconds configuration. |
Configuration Parameters
- address: The full URL of your Hashicorp Vault server.
- mount: The KV secrets engine mount point (e.g.,
secret). - auth: Object containing the authentication method and active token.
- cache_ttl_seconds: Time-to-live for cached secrets, defaulting to 300 seconds.
Vault Client for Hashicorp Advanced Features
- Support for multiple authentication methods including Token, AppRole, and Kubernetes auth.
- Pipe-friendly output for single-key lookups, making it easy to use secret values in shell scripts.
- Automated secret merging on 'put' commands to maintain data integrity within paths.
- Zero-dependency implementation using only Node.js standard libraries for high portability.
- Configurable TLS verification for environments utilizing self-signed certificates.
SKILL.md
Loading
Related Openclaw Skills
Spend Pulse
A proactive financial monitoring skill that tracks credit card spending against budgets using Plaid and pace-based alerting.
Professional Lottery Assistant (amcjt-lottery-pro)
A comprehensive AI agent skill for Openclaw Skills that handles lottery result queries, ticket OCR, and automated win verification via MCP.
Professional Lottery Assistant (amcjt-lottery-pro)
A professional AI-powered lottery assistant for real-time result tracking, ticket OCR recognition, and automated win verification via the MCP protocol.
TranslateFlow
An AI-powered translation API providing multi-language localization and tone-aware content adaptation for developers.
OpenClaw Self-Update
A specialized skill designed to automate the process of updating OpenClaw to the latest version via npm and restarting the gateway.
Scholar Research Skill
A specialized tool for searching, analyzing, and summarizing peer-reviewed academic papers from open-access repositories with automated credibility scoring.
Featured*
