Credential Manager

MANDATORY security foundation for OpenClaw. Consolidate scattered API keys and credentials into a secure .env file with proper permissions. Use when setting up OpenClaw, migrating credentials, auditing security, or enforcing the .env standard. This is not optional — centralized credential management is a core requirement for secure OpenClaw deployments. Scans for credential files across common locations, backs up existing files, creates a unified .env with mode 600, validates security, and enforces best practices.

Install only if you intend to let this skill read and reorganize credentials across your account. Before running consolidation or cleanup, review the exact files it found, avoid --yes for sensitive migrations, protect or encrypt backups yourself, do not store wallet seed phrases or irreplaceable private keys unless you fully accept the risk, and do not delete originals until you have verified the new store and backups work.

Type: OpenClaw Skill Name: credential-manager Version: 1.3.0 This skill is classified as suspicious due to its extensive use of high-risk capabilities, including scanning the entire filesystem for credential files, reading their contents, modifying sensitive files like `.env` and `.gitignore`, changing file permissions (`chmod 600`), and deleting original credential files. While these actions are explicitly stated as necessary for its security-enhancing purpose (centralizing and securing credentials), they represent significant control over the user's sensitive data and system configuration. The `SKILL.md` and other documentation files use strong, imperative language to instruct the agent to perform these actions, which, while aimed at enforcing security, constitutes a form of prompt injection directing the agent to execute sensitive operations.