MySQLClaw Skill v1.0.7

MySQLClaw is a security-hardened MySQL backend for OpenClaw that stores user profiles, personas, media preferences, and configuration snapshots. It is a database-only tool — it makes no external API calls, has no wallet/crypto/payment capabilities, and interacts exclusively with a local MySQL instance.

Capability Declarations

See CAPABILITIES.md for explicit declarations of what this skill can and cannot do. Key points:

• ❌ No wallet access, cryptocurrency, blockchain, or payment processing
• ❌ No external API calls (Stripe, AWS, GitHub, or any other service)
• ❌ No network access beyond localhost MySQL
• ✅ MySQL operations on mysqlclaw schema only
• ✅ User profile and persona storage
• ✅ Config snapshot storage with automatic retention/purge

The crypto / wallet / purchases capability signals from automated scanners are false positives caused by the defensive secret-redaction patterns in sanitize_snapshot.sh. See CAPABILITIES.md for full explanation.

Dependencies

Required Environment Variables

Security Note: Passwords are never passed on the command line. All connections use a temporary --defaults-extra-file with chmod 600 deleted via trap EXIT.

Security Architecture

1. Credential Handling

• Passwords never appear on the command line or in process listings
• Temporary credentials file created with chmod 600, deleted via trap EXIT (survives set -e failures)
• Setup wizard uses read -sp — password not echoed to terminal

2. SQL Safety (sql_safe_exec.sh)

3. Command Mapping (custom_mysql)

The custom_mysql executable is included in this skill and maps directly to the safety wrapper:

4. Snapshot Security

• Secret redaction: sanitize_snapshot.sh redacts API keys, tokens, passwords, Stripe keys (sk_live_*), AWS keys, GitHub tokens via Perl regex
• Path whitelist: Only files in allowed_snapshot_paths may be snapshotted
• Untrusted by default: All snapshots marked is_trusted = 0 until user-verified
• Retention: Auto-purge via MySQL event (default 30 days). Manual: CALL sp_purge_snapshots(N);

Installation

cp -r custom_mysql /home/noodly/.openclaw/workspace/skills/
cd /home/noodly/.openclaw/workspace/skills/custom_mysql
./setup_wizard.sh

Creating a Least-Privilege MySQL User

CREATE USER 'mysqlclaw'@'localhost' IDENTIFIED BY 'strong_password';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, INDEX, EVENT, EXECUTE
    ON mysqlclaw.* TO 'mysqlclaw'@'localhost';
FLUSH PRIVILEGES;

Files

Changelog

See changelog.md for full version history.