credential-manager

What This Skill Does

The credential-manager is the mandatory security backbone of the OpenClaw ecosystem. It acts as an automated security auditor and consolidation engine, designed to eliminate "secret sprawl"—the dangerous practice of storing API keys and authentication tokens in scattered, insecure locations. The skill scans your entire filesystem for exposed credentials, backs up found files with secure permissions, and migrates them into a single, encrypted .env file located at ~/.openclaw/.env with strict 600 file permissions. Beyond simple migration, it provides advanced security features including GPG encryption for highly sensitive data like wallet private keys and mnemonic seed phrases, credential rotation tracking, and an intensive deep-scanning mode (--deep) that greps through source code files to catch hardcoded secrets before they are committed to version control.

Installation

To integrate this essential security layer into your OpenClaw environment, execute the following command in your terminal:

clawhub install openclaw/skills/skills/teeclaw/openclaw-credential-manager

Once installed, it is recommended to run an initial audit immediately to ensure your current deployment complies with the OpenClaw security standard.

Use Cases

• Initial Deployment Security: Enforcing the "Single Source of Truth" principle during the first setup of an OpenClaw instance.
• Security Auditing: Periodically scanning a workspace to detect if a skill or process has inadvertently written a secret to a local configuration file.
• Credential Migration: Safely moving keys from legacy project folders into the hardened .env storage.
• Hardcoded Secret Removal: Using the --deep scan feature to find and sanitize sensitive data accidentally hardcoded into scripts or Python/Node.js files.
• Compliance & Rotation: Updating keys and ensuring that high-value assets remain encrypted via GPG protocols.

Example Prompts

1. "Credential-manager, run a full system scan and consolidate all detected API keys into the centralized .env file."
2. "Perform a deep scan for any hardcoded secrets in my current project directory and report the file paths and line numbers."
3. "Encrypt my wallet mnemonic using GPG and update my rotation schedule for the AWS credentials."

Tips & Limitations

• Strict Permissions: Always ensure the target directory ~/.openclaw is set to 700 to prevent unauthorized local user access.
• GPG Setup: The GPG encryption feature requires a pre-configured GPG keypair on your system. Ensure your GPG agent is active before attempting to encrypt high-value secrets.
• Deep Scanning: The --deep flag is resource-intensive. Run it during off-peak hours or when your system is not under heavy load to ensure complete coverage of your filesystem.
• Non-Negotiable: Remember that this tool enforces a strict security policy. Modifying the internal path of the .env file is strongly discouraged as it may break other OpenClaw skills that rely on this standard location.