mema-vault

What This Skill Does

The mema-vault skill serves as an hardened, AES-256 encrypted credential management layer for the OpenClaw ecosystem. Designed specifically for developers and automated agents, it acts as a local security sandbox that prevents sensitive authentication tokens from leaking into environment logs or standard config files. By leveraging the industry-standard Fernet (cryptography) library, the vault ensures that every piece of data—be it a database password, an API secret, or a private SSH key—is encrypted at rest using a mandatory Master Key stored in volatile environment variables.

Installation

To integrate mema-vault into your OpenClaw environment, execute the following command in your terminal:

clawhub install openclaw/skills/skills/1999azzar/mema-vault

Ensure that you have the cryptography Python package installed in your current virtual environment. Before performing any operations, you must define the master key via your system environment: export MEMA_VAULT_MASTER_KEY='your-strong-key-here'. Failure to set this will result in initialization errors.

Use Cases

• Automated API Management: Safely store provider tokens for services like AWS, OpenAI, or GitHub that the AI needs to access periodically.
• Database Connectivity: Manage complex database connection strings without exposing them in plaintext inside your connection scripts.
• Credential Rotation: Use the built-in storage methods to regularly cycle keys, ensuring limited blast radius if a single token is compromised.

Example Prompts

1. "I need to configure a new database connection. Please store the password for service 'production-db' for user 'admin' using the mema-vault skill."
2. "Retrieve the API key for my OpenAI account from the vault so that I can use it in the current session."
3. "List all credentials currently managed by mema-vault to see which services are already authenticated."

Tips & Limitations

• Master Key Security: The vault is only as secure as your Master Key. Do not store the key in your shell history file or hardcode it in scripts. Utilize a proper system secret manager or keep it in your local session environment.
• Visibility: Always use the --show flag with extreme caution. The skill defaults to masking credentials to prevent accidental exposure via log scraping or screen sharing. When using this skill in production pipelines, ensure that your log level is set to suppress the output of masked fields.