Vault

Secure local password storage tool with AES-256-GCM encryption. Store, retrieve, and manage passwords with CLI commands.

This plugin appears to implement what it claims: a local AES-256-GCM encrypted vault. Before installing, consider the following: - Keep the master key secret and do not commit it to source control; if you place it in the OpenClaw config file that config will contain a persistent secret. - The vault stores encrypted data at ~/.vault/passwords.json by default—set strict file permissions (chmod 600) and add the directory to .gitignore. - Backup your master key; losing it will make stored passwords unrecoverable. - The code runs locally and contains no network calls, but only install if you trust the plugin source (verify the GitHub repo and author). For high-value secrets, prefer a well-audited password manager or cryptographic audit.

Type: OpenClaw Skill Name: vault Version: 1.1.2 The OpenClaw Vault skill bundle provides a secure local password storage tool using AES-256-GCM encryption. The `index.js` code correctly implements strong cryptographic practices, including scrypt for key derivation with a random 32-byte salt per password, and a random 12-byte IV per password, as detailed in `SKILL.md` and `README.md`. It explicitly requires a `VAULT_MASTER_KEY` (from environment or config) and throws an error if not set, preventing insecure operation. Data is stored locally in the user's home directory (`~/.vault/passwords.json`) and there are no external network calls, shell injections, or suspicious dependencies (`package.json` lists no dependencies). The `CHANGELOG.md` transparently documents a past critical security fix regarding fixed salt, indicating a commitment to security rather than malicious intent. All instructions in `SKILL.md` and `README.md` are benign and align with the stated purpose.