secure-autofill 🔐

This skill documents how to use the secure-autofill plugin tools:

• vault_suggest — find likely 1Password items
• vault_fill — fill browser DOM fields with secrets (agent never sees credentials)

Architecture

Agent orchestrates; plugin handles secrets. The agent provides element refs from browser.snapshot; the plugin types secrets into the page.

Prerequisites

• Tools available (if tool allowlists are in use): vault_suggest, vault_fill
• A working non-headless Chrome on WSL (many sites block headless)
• Gateway environment has required env vars

Concrete checks:

command -v google-chrome || command -v google-chrome-stable

Configuration (portable)

Machine-specific environment should NOT be hardcoded in this document.

• Example (do not edit): ~/.openclaw/skills/secure-autofill/config.env.example
• Real (machine-specific): ~/.openclaw/skills/secure-autofill/config.env
• Gateway env file (recommended destination): ~/.config/openclaw/env

Typical keys:

• DISPLAY
• WAYLAND_DISPLAY
• OP_SERVICE_ACCOUNT_TOKEN (do not commit; do not paste into chat)

Initialization / installation / onboarding (WSL)

Preferred (chat-first)

Because the primary interface is chat (Telegram), the preferred onboarding flow is:

1. Ask Boss which values to set (DISPLAY, WAYLAND_DISPLAY, whether to set OP_SERVICE_ACCOUNT_TOKEN).
2. Write/update the real skill-local env file: config.env.
3. Optionally update the gateway env file (~/.config/openclaw/env) with per-key confirmation.
4. If applicable, detect whether openclaw-gateway is managed by systemctl --user and offer to restart.

Optional (terminal)

If you are running in a real terminal, you can use the interactive onboarding script:

~/.openclaw/skills/secure-autofill/scripts/onboard.sh

1) Install Google Chrome (.deb)

Ubuntu 22.04 moved Chromium to snap which doesn't work well in WSL. Install Chrome directly:

# Add Google apt source
wget -qO- https://dl.google.com/linux/linux_signing_key.pub \
  | sudo gpg --dearmor -o /usr/share/keyrings/google-linux-signing-keyring.gpg

echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-linux-signing-keyring.gpg] http://dl.google.com/linux/chrome/deb/ stable main" \
  | sudo tee /etc/apt/sources.list.d/google-chrome.list

# Install
sudo apt update && sudo apt install -y google-chrome-stable

2) Configure gateway environment (non-headless + 1Password token)

1. Create/update ~/.config/openclaw/env.
2. Run onboarding to generate the real env file (skill-local):

~/.openclaw/skills/secure-autofill/scripts/onboard.sh

3. Copy the needed variables from the skill-local config.env into the gateway env file (~/.config/openclaw/env).
4. Ensure the gateway service loads the env file: