AES-256 encrypted secrets manager for OpenClaw agents. Store API keys, tokens, and credentials in a secure local vault instead of plain-text .env files. Feat...

What to check before installing - Source and provenance: the package contains a full Python project and CLI. Confirm you trust PHRAIMWORK LLC and the repository URL in pyproject.toml before installing. - Cryptography: the library falls back to a custom 'stdlib' AES-like implementation when the 'cryptography' package is not installed. That fallback is explicitly marked as "less battle-tested" and appears to be a custom construction (hashlib-based block primitive). Do NOT rely on this for high-value secrets — install with the 'secure' extras (pip install armorclaw[secure]) or ensure the environment has the 'cryptography' package. - Scanning & importing: the default scanner looks in broad locations (~/projects, ~/Documents). That can read many files and the import flow can delete original .env files if you choose that option. Review any found files before importing and prefer 'backup' over 'delete'. - Auto-unlock persistence: the CLI can write an encrypted master password into ~/.openclaw/openclaw.json to enable bot auto-unlock. Even encrypted, this increases exposure — only enable for fully trusted agents and machines. Prefer interactive unlocking where possible. - Network calls: external IP detection uses third-party services (api.ipify.org, ifconfig.me, icanhazip.com). These requests reveal your external IP to those services; consider the privacy implications and whether you want that traffic. - Cross-skill sharing: the vault allows any skill to request keys (the API accepts a 'skill' parameter and logs accesses). The design relies on skill-level trust and auditing; there is no per-skill ACL enforcement. Only enable cross-skill access for trusted skills and monitor access logs. - Recommended mitigations: install the 'cryptography' dependency, audit the code (especially crypto.py and machine_crypto.py), run tests in a disposable environment first, back up any .env files before running imports, and carefully review any changes to ~/.openclaw/openclaw.json after setup. If you are not comfortable with the above risks (config writes, scanning Documents, fallback crypto), treat this skill as not suitable for sensitive production secrets.

Type: OpenClaw Skill Name: armorclaw Version: 1.0.0 ArmorClaw is a secrets management utility that exhibits high-risk behaviors despite its stated security purpose. Key indicators include a broad filesystem scanner in `importer.py` that recursively searches `~/Documents` and `~/projects` for `.env` files, and logic in `cli.py` that modifies the global `openclaw.json` configuration to store a machine-bound master password. Furthermore, `crypto.py` contains a highly non-standard and insecure 'fallback' encryption implementation (a custom XOR-based construction) used when the standard library is unavailable, which represents a significant cryptographic vulnerability rather than intentional malice.