Credential Manager

MANDATORY security foundation for OpenClaw. Consolidate scattered API keys and credentials into a secure .env file with proper permissions. Use when setting up OpenClaw, migrating credentials, auditing security, or enforcing the .env standard. This is not optional — centralized credential management is a core requirement for secure OpenClaw deployments. Scans for credential files across common locations, backs up existing files, creates a unified .env with mode 600, validates security, and enforces best practices.

Install only if you intentionally want this skill to inspect and migrate credential files. Run scan-only first, review every path, avoid --yes for real migrations, verify ~/.openclaw/.env and backups before cleanup, do not consolidate wallet seed phrases or private keys unless you have a strong reason, and avoid sourcing or printing secrets in shell sessions.

Type: OpenClaw Skill Name: credential-manager Version: 1.3.0 This skill is classified as suspicious due to its extensive use of high-risk capabilities, including scanning the entire filesystem for credential files, reading their contents, modifying sensitive files like `.env` and `.gitignore`, changing file permissions (`chmod 600`), and deleting original credential files. While these actions are explicitly stated as necessary for its security-enhancing purpose (centralizing and securing credentials), they represent significant control over the user's sensitive data and system configuration. The `SKILL.md` and other documentation files use strong, imperative language to instruct the agent to perform these actions, which, while aimed at enforcing security, constitutes a form of prompt injection directing the agent to execute sensitive operations.