SocialVault

社交平台账号凭证管理器。提供登录态获取、AES-256-GCM 加密存储、定时健康监测和自动续期。Use when managing social media account credentials, importing cookies, checking login status, or automating...

This skill is largely coherent with its stated purpose: it uses node/npx, local files under vault/, and the builtin browser tool to import and verify social-media credentials and schedules periodic health checks. Before installing: 1) Review the vault-crypto.ts implementation (key generation, key file permission setting, in-memory clearing) to confirm keys are created with strict permissions and plaintext is reliably zeroed/cleared. 2) Confirm the TRUSTED_DOMAINS list matches only the official domains you expect (adding new platforms requires code changes). 3) Understand that cron jobs will periodically decrypt credentials in memory and make network requests to platform endpoints—ensure you want automated checks. 4) Confirm vault/ will not be backed up or committed to version control and that vault-key is protected (600). If you can audit the missing/omitted files (especially vault-crypto.ts and any remaining scripts/tests) and verify no hidden outbound endpoints exist, my confidence would increase to high.

Type: OpenClaw Skill Name: social-vault Version: 0.1.7 SocialVault is a credential management skill for social media accounts that prioritizes security through local AES-256-GCM encryption and strict domain whitelisting. It stores credentials in an encrypted vault (`vault/vault.enc`) using a local key (`vault/vault-key`) and implements a hardcoded whitelist in `scripts/session-verifier.ts` to ensure authentication headers are only sent to official platform domains (e.g., bilibili.com, xiaohongshu.com). The skill includes robust logic for browser fingerprinting, cookie parsing, and automated health checks, with explicit instructions in `SKILL.md` for the agent to clear sensitive data from memory and avoid displaying full credentials in logs or dialogue.