← Back to Skills Marketplace

Bagman

Name: Bagman
Author: allprogramming9999

by allprogramming9999 · GitHub ↗ · v0.1.0 · MIT-0

cross-platform ✓ Security Clean

218

Downloads

Stars

Active Installs

Versions

Install in OpenClaw

/install master-skills

Description

Secure key management for AI agents. Use when handling private keys, API secrets, wallet credentials, or when building systems that need agent-controlled fun...

Usage Guidance

This skill appears to be what it says: a set of patterns and examples for using 1Password to manage agent secrets. Before installing/use: (1) verify you have the official 'op' CLI from 1Password and understand how to sign in (the skill assumes an active session/OP_SESSION token), (2) confirm that any '.env' or env-file referenced is a template that does not contain real secrets, (3) limit agent session keys to minimal permissions and short lifetimes as recommended, (4) audit 1Password access logs and restrict the agent's vault/item permissions, (5) test the provided sanitize_output routines for false positives/negatives in your environment, and (6) be cautious about giving an autonomous agent any ability to request new session keys without human approval. If you need higher assurance, ask the author to document the authentication prerequisites (how to safely obtain OP_SESSION tokens) and to clarify the env-file example so it cannot be misused to write secrets to disk.

Capability Analysis

Type: OpenClaw Skill Name: master-skills Version: 0.1.0 The 'bagman' skill bundle is a security-focused resource providing patterns and code snippets for secure secret management in AI agents. It includes defensive measures such as output sanitization (regex-based redaction of keys), prompt injection detection, and the use of 1Password CLI (op) for runtime secret retrieval. The content in SKILL.md is educational and aimed at preventing accidental data leaks and unauthorized access, with no evidence of malicious intent or harmful instructions.

Capability Assessment

✓ Purpose & Capability

Name/description (secure key management) aligns with requested binary 'op' and the instructions which exclusively describe using 1Password CLI and session keys. No unrelated services or credentials are requested.

ℹ Instruction Scope

Instructions stay within the scope of retrieving and sanitizing secrets from 1Password. A few ambiguous items: (1) the example 'op run --env-file=.env.tpl -- node agent.js' claims 'key never touches disk' but references an env-file (it must be clear that that file is a template without secrets), and (2) the docs assume the 1Password CLI is already signed in (OP_SESSION or equivalent) but don't document that prerequisite or how to authenticate safely. Otherwise instructions do not direct any unexpected data exfiltration.

✓ Install Mechanism

This is instruction-only (no install spec, no downloaded code), so nothing is written to disk by the skill itself. Risk is limited to the user running the suggested commands and having the 'op' binary installed from an external source.

ℹ Credentials

The skill requires only the 'op' CLI and declares no env vars, which is proportional. However, it implicitly depends on a logged-in 1Password session (OP_SESSION_* env var or equivalent) and access to a 1Password account/vault; those credentials/session tokens are not documented in requires.env and should be considered necessary for operation.

✓ Persistence & Privilege

Skill does not request persistent presence (always:false) and does not modify other skills or system-wide config. It relies on agent invocation at runtime, which is the normal behavior.

How to Use

Make sure OpenClaw is installed (local or Docker)
Run the install command in chat: /install master-skills
After installation, invoke the skill by name or use /master-skills
Provide required inputs per the skill's parameter spec and get structured output

Version History

v0.1.0

Initial release: secure key management patterns for AI agents. - Introduces Bagman: a guide to safe handling of secrets (keys, API creds, wallet access) for AI agents. - Covers secure storage using 1Password CLI (`op`), session key delegation, and leak prevention. - Includes architecture overview, step-by-step agent workflow, and code snippets for key retrieval and sanitization. - Provides patterns for output sanitization, pre-commit hooks to stop secret leaks, and .gitignore examples. - Documents prompt injection defenses with input validation and isolation of wallet operations.

Metadata

Slug master-skills

Version 0.1.0

License MIT-0

All-time Installs 1

Active Installs 1

Total Versions 1

Frequently Asked Questions

What is Bagman?

Secure key management for AI agents. Use when handling private keys, API secrets, wallet credentials, or when building systems that need agent-controlled fun... It is an AI Agent Skill for Claude Code / OpenClaw, with 218 downloads so far.

How do I install Bagman?

Run "/install master-skills" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Bagman free?

Yes, Bagman is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Bagman support?

Bagman is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Bagman?

It is built and maintained by allprogramming9999 (@allprogramming9999); the current version is v0.1.0.

More Skills