OpenClaw Memory Audit

Scan the agent workspace and memory logs for leaked API keys, tokens, or sensitive credentials. Use when the user requests a security check, a memory audit,...

This skill appears to be a simple, local secrets scanner and does not exfiltrate data, but note the following before installing or running it: - The script only scans files under the workspace path you give it; it does NOT read agent memory stores or in-memory conversation logs even though the SKILL.md mentions 'memory logs'. If you need memory-store scanning, you'll need additional tooling or explicit instructions to the agent to access that store. - The scanner prints file paths and line numbers for matches (with values masked). Treat the output as sensitive: it reveals where a secret was found even if the secret value is partially redacted. - The regexes are intentionally broad (e.g., generic 32+/40+ char tokens) and can generate false positives. Review findings manually before revoking credentials. - Because the tool reads all text files recursively, run it in an environment where the agent is permitted to read the workspace (no unintended mounts). Consider running in a sandbox or with a copy of the workspace if you are concerned about accidental exposure of file metadata. If you want the skill to actually scan agent memory or a separate logs DB, ask the author to either: (1) document exactly which memory/log store it will access and request only the minimal API/credentials needed, or (2) include code that explicitly reads from that memory store (with clear, auditable behavior).

Type: OpenClaw Skill Name: openclaw-memory-audit Version: 1.1.2 The OpenClaw Memory Audit skill is designed for local, read-only scanning of the agent's workspace and memory logs for leaked API keys and credentials. The `SKILL.md` explicitly states its read-only nature and instructs the agent to run a local Python script (`scripts/scan_secrets.py`) and to recommend a recurring audit schedule using OpenClaw's `cron.list()` function, without modifying any configurations. The `scan_secrets.py` script correctly implements this by scanning files for predefined regex patterns, masking any found secrets before printing them to standard output, and making no network calls or system modifications. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts to subvert the agent's intended behavior.