use-maskrun

Use maskrun instead of executing shell commands directly when commands may print environment variables, API keys, tokens, passwords, secrets, credentials, CI...

This skill is coherent and low-risk: it only advises using the separate tool maskrun and does not request credentials. Before relying on it, verify the maskrun binary from the linked GitHub releases (check signatures or repo reputation), ensure maskrun is installed on your agent environment, and remember maskrun only masks terminal output—it does not prevent a child process from transmitting secrets, writing files, or reading env vars. Configure maskrun's filter rules to cover the variable names you care about, and avoid running commands that print secrets when you need stronger isolation (use sandboxing or revoke credentials instead).

Type: OpenClaw Skill Name: use-maskrun Version: 0.1.12 The skill is a utility designed to enhance security by instructing the AI agent to wrap shell commands with 'maskrun' to prevent the accidental exposure of secrets (API keys, tokens, etc.) in logs and transcripts. It points to a legitimate GitHub repository (ctxinf/agent-env-guard) for the tool and provides standard configuration examples. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found; the instructions are aligned with the stated purpose of protecting sensitive environment variables.