OpenClaw Credential Manager

MANDATORY security foundation for OpenClaw. Consolidate scattered API keys and credentials into a secure .env file with proper permissions. Includes GPG encryption for high-value secrets, credential rotation tracking, deep scanning, and backup hardening. Use when setting up OpenClaw, migrating credentials, auditing security, or enforcing the .env standard. This is not optional — centralized credential management is a core requirement for secure OpenClaw deployments.

This package contains real scripts that will scan your home directory for credentials, merge them into ~/.openclaw/.env, encrypt selected keys, and may delete the scattered credential files after backing them up. Before running anything: 1) Inspect the bundled scripts yourself (you have them) and confirm you trust the author — we see a hardcoded example path (/home/phan_harry) in docs which suggests the package was tailored or copied from another environment. 2) Do not run destructive commands yet — run scan.py and consolidate.py with dry-run/--backup-only modes and don't pass --confirm/--yes until you review backups. 3) Ensure 'gpg' is installed and understand the encryption model: this uses symmetric GPG (-c) with a passphrase (OPENCLAW_GPG_PASSPHRASE allowed) — supplying the passphrase via env var contradicts some documentation and can be insecure; prefer interactive entry or a secure secret manager. 4) Check backups produced in ~/.openclaw/backups before any cleanup and verify file permissions. 5) Consider alternatives (OS keyring/secret manager) for automated services that can't safely keep a GPG passphrase. If you want, I can: list the exact filesystem operations each script will perform, point out every place the code can delete or overwrite files, or produce a recommended safe run sequence (commands + flags) to evaluate outputs without destruction.

Type: OpenClaw Skill Name: openclaw-credential-manager Version: 2.0.0 The OpenClaw Credential Manager skill is designed to enhance the security posture of an OpenClaw deployment by centralizing, securing, and managing credentials. All scripts and documentation consistently focus on security best practices, such as enforcing file permissions (600 for files, 700 for directories), GPG encryption for high-value secrets, git-ignore protection, deep scanning for hardcoded secrets, and credential rotation tracking. The `CHANGELOG.md` explicitly details fixes for critical security vulnerabilities (e.g., backup file permissions) in version 2.0.0, indicating a proactive security-conscious development. While the skill handles sensitive data and modifies system configurations (like GPG agent settings), these actions are directly aligned with its stated purpose of securing credentials and do not show any evidence of intentional malicious behavior, data exfiltration, unauthorized remote control, or obfuscation for harmful purposes. The strong language in `SKILL.md` and `CORE-PRINCIPLE.md` serves to enforce security policies on the agent and user, not to prompt-inject for malicious actions.