credential-manager

What This Skill Does

The credential-manager is the foundational security layer for your OpenClaw ecosystem. It acts as a centralized vault, scanning your local environment for fragmented API keys, passwords, and sensitive tokens that are often scattered across various configuration folders or temporary memory files. By consolidating these disparate files into a single, highly secure ~/.openclaw/.env file, the skill eliminates potential leakage vectors and simplifies security audits. The manager enforces a strict 600 permission policy (read/write by owner only), validates credential formats, creates timestamped backups to prevent data loss during migration, and ensures that your sensitive information remains git-ignored, preventing accidental exposure in repositories.

Installation

To integrate this critical security layer, run the following command in your terminal:

clawhub install openclaw/skills/skills/callmedas69/credential-manager

Ensure that you have appropriate system permissions to modify files in your home directory, as the skill will need to create the ~/.openclaw/ directory and update your local .gitignore configurations.

Use Cases

This skill is essential for three primary scenarios:

1. Initial OpenClaw Setup: Use it to establish a secure foundation before adding other skills to your agent.
2. Security Audits: Use it to sweep your system for 'lost' keys or poorly protected legacy credential files.
3. Migration: Use it when moving or upgrading your OpenClaw installation to ensure all sensitive data is properly bundled and protected under the new standard.

Example Prompts

1. "Credential-manager, perform a full scan of my home directory and identify any scattered API keys or credential files that need consolidating."
2. "I need to harden my deployment; please run the credential-manager to consolidate my keys and ensure my .env file is set to mode 600."
3. "Back up my existing keys and consolidate them into the main OpenClaw environment file."

Tips & Limitations

Always review the generated backup files before performing the final cleanup command. The credential-manager is designed to be the single source of truth; therefore, avoid manually editing other local credential files once migration is complete. The skill currently supports common .env and .json patterns; if you have custom proprietary formats, you may need to manually define the mapping in the configuration phase. Remember that this tool is not a password manager for personal sites, but rather a dedicated vault for the system and AI agent service keys.