Nex Keyring

Manage and track local API keys, secrets, and tokens with rotation status, risk levels, auditing, and policy enforcement without storing actual secret values.

This package appears to do what it claims: locally scan .env files and environment variables, track key metadata and rotation history, and avoid storing actual secret values. Before installing or running setup.sh, consider: 1) Review the setup.sh wrapper path that is written — ensure it points to the skill files on your machine (it tries to locate SKILL_DIR but double-check). 2) The tool reads environment variables and .env files — only run it in contexts where you trust the host and operator, and avoid running on machines with untrusted processes. 3) There are small code/documentation inconsistencies (README mentions env overrides that aren't evident in the code) and at least one apparent coding bug (truncated/undefined variable in storage.list_secrets that may cause runtime errors). I recommend auditing the code locally (especially storage.list_secrets and any truncated sections), running setup.sh in a controlled environment or container, installing the cryptography package if you want Fernet encryption, and backing up any sensitive files before first run. If you want higher assurance, ask the author for a complete, non-truncated source and unit tests demonstrating behavior (or run it in an isolated VM/container).

Type: OpenClaw Skill Name: nex-keyring Version: 1.0.0 The nex-keyring skill is a local utility designed to track the rotation status of API keys and secrets without storing the actual sensitive values. Analysis of nex-keyring.py and lib/scanner.py confirms that the tool only captures metadata (key names, service types, and SHA256 hashes for change detection) from .env files and environment variables. The data is stored locally in a SQLite database (~/.nex-keyring/keyring.db), and the code lacks any network communication or exfiltration logic. While there is a minor discrepancy where documentation mentions Fernet encryption that isn't implemented in the storage layer, the overall behavior is consistent with its stated security-focused purpose.