Max Auth

Security authentication gate for OpenClaw sensitive actions. Deploys a local Node.js auth server with biometric passkeys (WebAuthn/Touch ID/Face ID) and mast...

This skill appears to implement a local auth server that needs Node.js and npm, but the registry metadata omitted the Node requirement — don't rely on the metadata alone. Before installing: (1) review the full auth-server.js (the listing was truncated) to confirm one-time secrets truly stay in memory and are not written to disk; (2) be cautious about exposing the server externally (reverse proxy or Tailscale examples) — only expose it with correct HTTPS and access controls; (3) note the code runs a local shell command ('tailscale status') if available — ensure your PATH and local binaries are trusted; (4) run npm install in an isolated environment (container or dedicated user) if you want to limit blast radius; (5) confirm you are comfortable with files created in ~/.max-auth (password hash, passkeys, audit log). If anything looks unexpected in the missing portions of auth-server.js, do not install or run it until clarified.

Type: OpenClaw Skill Name: max-auth Version: 2.2.0 The max-auth skill bundle provides a legitimate local authentication server designed to protect sensitive agent actions using master passwords and biometric passkeys (WebAuthn). The implementation in auth-server.js follows security best practices, including PBKDF2 password hashing with salts, rate limiting to prevent brute-force attacks, and audit logging. A notable security-enhancing feature is the 'secure secret handoff,' which allows users to provide credentials via a one-time browser form that stores data in memory only, preventing sensitive keys from appearing in chat transcripts. No evidence of data exfiltration, malicious execution, or unauthorized persistence was found.