password-manager

本地密码管理技能，支持添加、编辑、删除、搜索密码，支持分类管理、备注添加，数据存储在本地，支持导入导出和备份。当用户提到密码、账号、密码管理、保存密码、查找密码时使用此技能。

Do not trust this skill with real passwords until the issues below are addressed: 1) Code audit: the included password_manager.py stores the "password" field directly in JSON (no encryption). SKILL.md/README sometimes show "encrypted_password" — confirm whether encryption is implemented and, if missing, require the author to add well-known encryption (e.g., user-supplied master password-derived key, OS keystore integration) before using. 2) Missing files: the documentation references multiple helper modules that are not present; ask the author for the complete package or a clear list of implemented features. 3) Backups: the skill auto-creates backup files in ~/.workbuddy/data/backups; ensure backups are stored encrypted or in a secure location. 4) Testing: run the code in an isolated environment, inspect saved JSON contents, and verify there is no network activity. 5) Alternatives: consider established, audited password managers or require encryption tied to a master secret before storing sensitive accounts. If you decide to proceed temporarily, only store non-critical/test accounts and keep manual encrypted backups elsewhere.

Type: OpenClaw Skill Name: password-manager-pro Version: 1.0.0 The skill bundle implements a password manager that stores all user credentials in plain text in a predictable local file (~/.workbuddy/data/passwords.json). While the documentation in SKILL.md and README.md explicitly acknowledges the lack of encryption, this design represents a critical security vulnerability that facilitates credential theft by any local process. No evidence of intentional data exfiltration or hidden backdoors was found in the provided code (scripts/password_manager.py and scripts/password_generator.py), but the high-risk nature of the data handled combined with the absence of basic security controls warrants a suspicious classification.