auth-guard

What This Skill Does

The auth-guard skill provides a standardized, deterministic framework for managing API credentials and authentication lifecycles within the OpenClaw agent environment. It eliminates "missing key" regressions by enforcing a centralized authentication pattern. Instead of scattered, ad-hoc curl requests or fragile inline secret handling, auth-guard mandates that all authenticated interactions pass through a controlled helper script located in workspace/.pi/. This tool ensures that credentials are sourced predictably—prioritizing environment variables followed by secure configuration files—and validates connection status during startup or heartbeat intervals. By implementing this, you prevent unauthorized states from stalling automated tasks and ensure that credentials never leak into logs, chat history, or memory notes.

Installation

To add this skill to your agent's environment, execute the following command in your terminal:

clawhub install openclaw/skills/skills/adainthelab/auth-guard

Ensure that your environment meets the runtime requirements by confirming the presence of bash, curl, and python3. You can verify this by running command -v bash curl python3 before initiating the installation.

Use Cases

• Preventing Auth Drift: Ideal for agents that frequently lose connection states due to environment reset or session timeout, ensuring an automatic re-validation check before any task execution.
• Standardizing API Access: Use this when working with services like GitHub, Slack, or proprietary APIs where raw curl commands are risky and prone to syntax errors regarding header formatting.
• Safe Credential Management: Essential for teams building agents that interact with sensitive endpoints, ensuring that secret paths are locked to ~/.config/<service>/ locations rather than arbitrary workspace files.
• Automated Startup Validation: Use the auth-guard pattern at the beginning of HEARTBEAT.md or AGENTS.md loops to guarantee that the agent is fully authenticated before it attempts any data retrieval or external API mutation.

Example Prompts

1. "Auth-guard, set up a new authentication flow for the Jira API. Store the credentials in ~/.config/jira/credentials.json and ensure my heartbeat scripts use the helper method."
2. "I'm getting 401 errors on my Slack integration. Can you integrate the auth-guard skill to verify my token before the daily reporting task runs?"
3. "Check if my Moltbook integration is configured correctly using the auth-guard startup check pattern and ensure no keys are visible in the history logs."

Tips & Limitations

• Strict Scoping: Never point your --cred-file at general directories or user-accessible workspace subdirectories. Keep sensitive configs inside system-protected ~/.config/ folders.
• Noise Reduction: Configure the fallback policies to be explicit. Rather than crashing the entire agent, log a single, clean error message indicating that authentication is required before continuing.
• Integration: Always refer to references/snippets.md for policy blocks that can be copy-pasted directly into your HEARTBEAT.md files to maintain uniformity across all your agents.
• Limitation: This tool requires manual setup of the auth_check.sh script for each unique service; it is not a "set-it-and-forget-it" magic wand but a framework for professionalizing your agent's security posture.