keychain-bridge
Manage secrets via macOS Keychain instead of plaintext files. Migrate existing secrets, read/write keychain entries, bridge to files for bash tools, audit for leaks, diagnose access issues. Use when asked about secrets, keychain, credentials, API keys, or security hardening on macOS.
Why use this skill?
Eliminate plaintext credential risks on macOS. Use keychain-bridge to migrate secrets, audit for leaks, and manage keys securely within your OpenClaw workflow.
Install via CLI (Recommended)
clawhub install openclaw/skills/skills/euda1mon1a/keychain-bridgeWhat This Skill Does
The keychain-bridge skill serves as a robust security wrapper for the OpenClaw AI agent, transitioning secret management from insecure, plaintext files on your local disk to the encrypted, native macOS Keychain. By leveraging the system-level security of the macOS Keychain, this skill ensures that sensitive credentials—such as API keys, tokens, and passwords—are protected by the system's own credential store, significantly reducing the attack surface for local data theft. The bridge also includes a sophisticated file-bridge mechanism, allowing legacy bash scripts that require file-based input to access secrets securely at runtime without leaving persistent vulnerabilities on your file system.
Installation
To integrate this security suite into your OpenClaw environment, execute the following command in your terminal:
clawhub install openclaw/skills/skills/euda1mon1a/keychain-bridge
After installation, ensure you have the keyring Python library installed across all relevant Python interpreters on your system. Because macOS often manages multiple Python versions, it is critical to run pip3 install keyring for each environment that your agent interacts with. Verify the integration by running the health check script provided in the documentation.
Use Cases
This skill is essential for users who prioritize security hardening. Primary use cases include: migrating legacy plaintext credentials from dotfiles to the system keychain, auditing existing project directories for potential secret leaks, and automating secure credential injection for command-line tools that do not natively support password managers. It is the go-to solution when performing security audits or transitioning from development to production-grade security standards.
Example Prompts
- "Migrate all my plaintext secrets in ~/.openclaw/secrets/ to the macOS Keychain."
- "Run a security audit on my projects to ensure no API keys are being stored in plaintext."
- "My bash scripts can't read my credentials; can you set up the keychain file bridge for me?"
Tips & Limitations
Note that while the macOS Keychain is highly secure, it relies on system-level accessibility permissions. If you encounter errors, check that your terminal emulator has Full Disk Access or Accessibility permissions granted in System Settings. When using the file-bridge, secrets are temporarily materialized on disk; ensure these files are generated in a volatile or protected memory location if possible. Always prefer Python-based access via keychain_helper over the file-bridge approach whenever your toolchain supports it.
Metadata
Not sure this is the right skill?
Describe what you want to build — we'll match you to the best skill from 16,000+ options.
Find the right skillPaste this into your clawhub.json to enable this plugin.
{
"plugins": {
"official-euda1mon1a-keychain-bridge": {
"enabled": true,
"auto_update": true
}
}
}Tags(AI)
Flags: file-write, file-read, code-execution