🛡️ Credential Vault / 凭证保险箱

GPG AES-256 encrypted credential management. Requires: GPG (gnupg) installed, Python 3.8+, CRED_MASTER_PASS env var for non-interactive use. Use when the use...

This credential vault is internally coherent and implements a local GPG-encrypted file approach. Before installing or using it, consider the following: (1) Prefer interactive entry via gpg-agent/pinentry rather than exporting CRED_MASTER_PASS — environment variables can be read by other same-user processes on Linux (/proc/*/environ). (2) The tool creates a plaintext JSON temp file for a short time; on systems without encrypted tmpfs this can be recoverable — consider mounting /tmp as tmpfs or setting TMPDIR to a ram-backed location if you need stronger guarantees. (3) The helper prints secrets to stdout; avoid running it in contexts where other processes could capture stdout, and avoid exposing secrets in logs. (4) This is single-user, local storage (no key rotation, no tamper detection) — for enterprise or multi-tenant use consider an OS keyring, HashiCorp Vault, or cloud KMS. (5) Review the included scripts before use and keep the credential file and skill directory permissions restricted (600/owner-only). If you cannot accept the env-var and temp-file trade-offs, do not use the non-interactive mode and prefer interactive gpg-agent/pinentry flows.

Type: OpenClaw Skill Name: mjolnir-credential-vault Version: 1.3.1 The skill provides a GPG-encrypted credential vault that follows several security best practices in its Python implementation (cred_manager.py), such as using --passphrase-fd to avoid process-list leaks and implementing secure temporary file deletion. However, the shell helper script (scripts/cred_helper.sh) contains a critical command injection vulnerability where shell variables ($service and $key) are directly interpolated into a Python one-liner's string literals. This flaw allows for arbitrary code execution if service names are maliciously crafted, meeting the criteria for a 'suspicious' classification due to high-risk vulnerabilities.