PassManager

本地加密密码管理系统，基于AES-256和SQLite，支持多级权限、自动备份，替代1Password实现企业安全可控密码管理。

Do not install this into a production or sensitive OpenClaw environment yet. Key issues: the SKILL.md promises AES-256/TLS/key rotation/backups but the only included code uses weak 'base64+reverse' encoding and no key management; many files and scripts described in the documentation are missing; the code writes persistent data under /root/.openclaw/secrets (the platform's secrets area) which could mix with agent secrets. Before using: 1) require the author/source repository and verify integrity (there's no homepage and source is 'unknown'); 2) obtain the missing scripts and full source; 3) perform a code review to confirm proper AES (with secure key derivation, KDF, IV handling), TLS and network code, safe backup endpoints, and no hidden exfiltration; 4) change default data paths to a controlled directory (do not reuse platform secrets directory) and run in an isolated environment; 5) prefer a well-audited password manager or have this code security-audited and fixed (implement proper cryptography, secure logging, and access control) before entrusting real secrets. If you want, I can list the exact code changes needed to bring the implementation closer to the claimed security posture.

Type: OpenClaw Skill Name: passmanager Version: 1.0.0 The skill bundle claims to be a secure, AES-256 encrypted password manager in SKILL.md, but the actual implementation in scripts/passmanager.py uses a trivial and insecure Base64-reversal scheme for 'encryption.' There is a significant discrepancy between the documentation's security claims (AES-256, TLS 1.3) and the code's reality, which constitutes 'snake oil' security. Additionally, the script contains hardcoded assistant identities (e.g., '小新') and lacks many of the administrative commands described in the documentation, suggesting the code is either incomplete or intentionally misleading regarding its security properties.