← Back to Skills Marketplace
78
Downloads
1
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install skill-state-manager
Description
A Meta Skill that manages API keys and state persistence for other tools. Invoke whenever a tool requires authentication or fails with 401/403 errors.
Usage Guidance
This skill claims to simplify credential handling but leaves important security details out. Before installing or enabling it consider: (1) Ask the skill author to declare the exact config paths in metadata and explain how files are secured. (2) Do not paste highly sensitive secrets (AWS keys, private keys, service account JSONs) into chat unless you trust the skill and know how they will be stored. (3) Prefer secure stores (OS keyring, encrypted file, or platform-provided secret manager) over plaintext JSON; request that the skill set file permissions (600) or use encryption. (4) Require the skill to restrict prompting to only the minimal fields necessary and show the user exactly what will be written before writing. (5) If you cannot verify these protections, avoid using this skill for high-value credentials or disable autonomous invocation so prompts require explicit user action. Providing the skill with a clear design for secure storage (and updating metadata) would reduce the concerns raised here.
Capability Analysis
Type: OpenClaw Skill
Name: skill-state-manager
Version: 0.0.1
The 'skill-state-manager' skill (SKILL.md) acts as a meta-tool that instructs the AI to intercept authentication failures from other skills and prompt the user to provide sensitive credentials (API keys, tokens) directly within the chat interface. It then directs the AI to store these secrets in plaintext JSON files at predictable local paths, such as `~/.ai-skills-state/` or `~/.claude/skills-state/`. While presented as a convenience for managing tool state, this pattern introduces significant security risks by centralizing unencrypted secrets in well-known locations and encouraging insecure secret-handling practices.
Capability Assessment
Purpose & Capability
The declared purpose (meta skill to manage API keys) matches the SKILL.md behavior, but the registry metadata lists no required config paths while the instructions mandate writing/reading ~/.claude/skills-state/ and ~/.ai-skills-state/. That mismatch (metadata omits persistent filesystem use) is an incoherence and reduces transparency about what the skill will access.
Instruction Scope
Runtime instructions explicitly tell the agent to pause tool actions, ask the user for secrets in chat, and save them to local JSON files via a Write tool. The instructions do not limit what secrets may be requested, do not require confirming the minimal scope of data to store, and do not specify permissions/encryption — enabling social-engineering-style requests and insecure storage.
Install Mechanism
Instruction-only skill with no install spec or downloaded code. Low installation risk because nothing is written to disk by an installer, but runtime behavior still writes files via the agent's Write tool.
Credentials
No environment variables or credentials are declared, which superficially reduces risk, but the skill's purpose is to collect and persist credentials for other tools. Requiring broad, unspecified secrets (and storing them plaintext) is disproportionate without explicit limits, encryption, or an audit trail.
Persistence & Privilege
The skill requests persistent storage of secrets on-disk (home-directory JSON files) but does not declare that persistence in metadata or provide mitigations (file permissions, encryption, keyring/backing store). Autonomous invocation (allowed by default) combined with the ability to solicit and store secrets increases blast radius if the agent or another skill is compromised.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install skill-state-manager - After installation, invoke the skill by name or use
/skill-state-manager - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.0.1
Initial release of Skill State Manager (SSM), a meta skill for seamless API key and state management:
- Enables native conversational prompts for secrets when third-party tools require authentication or fail with 401/403 errors.
- Automatically detects platform (Claude Code, Codex, or other CLIs) and adapts credential storage path accordingly.
- Securely saves user-provided tokens/keys in standard local directories for future reuse.
- Eliminates the need for per-tool manual config, token pasting, or hardcoded secrets.
- Only activates for third-party tools needing secrets, not for public or built-in tools.
Metadata
Frequently Asked Questions
What is skill-state-manager?
A Meta Skill that manages API keys and state persistence for other tools. Invoke whenever a tool requires authentication or fails with 401/403 errors. It is an AI Agent Skill for Claude Code / OpenClaw, with 78 downloads so far.
How do I install skill-state-manager?
Run "/install skill-state-manager" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is skill-state-manager free?
Yes, skill-state-manager is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does skill-state-manager support?
skill-state-manager is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created skill-state-manager?
It is built and maintained by QipengGuo (@qipengguo); the current version is v0.0.1.
More Skills