Credential Manager

MANDATORY security foundation for OpenClaw. Consolidate scattered API keys and credentials into a secure .env file with proper permissions. Use when setting up OpenClaw, migrating credentials, auditing security, or enforcing the .env standard. This is not optional — centralized credential management is a core requirement for secure OpenClaw deployments. Scans for credential files across common locations, backs up existing files, creates a unified .env with mode 600, validates security, and enforces best practices.

Install only if you intentionally want OpenClaw credentials centralized in ~/.openclaw/.env. Run scan first, review every discovered path, avoid importing unrelated app secrets or wallet seed phrases by default, do not use --yes until you understand the exact changes, verify or restrict backup permissions, and run cleanup only after testing the new .env and confirming rollback works.

Type: OpenClaw Skill Name: credential-manager Version: 1.3.0 This skill is classified as suspicious due to its extensive use of high-risk capabilities, including scanning the entire filesystem for credential files, reading their contents, modifying sensitive files like `.env` and `.gitignore`, changing file permissions (`chmod 600`), and deleting original credential files. While these actions are explicitly stated as necessary for its security-enhancing purpose (centralizing and securing credentials), they represent significant control over the user's sensitive data and system configuration. The `SKILL.md` and other documentation files use strong, imperative language to instruct the agent to perform these actions, which, while aimed at enforcing security, constitutes a form of prompt injection directing the agent to execute sensitive operations.