Publish Passwords

Local credential vault with OS keychain integration, encrypted storage, and session-based access control.

This skill looks internally consistent for a local encrypted vault and uses reasonable primitives (age, OS keyrings). Before installing, verify: (1) you have 'age' from a trusted source; (2) the agent implementation will actually enforce the 'must not' rules (instructions here are not code); (3) network calls (k-anonymity/leak checks) go to trusted endpoints and you accept that they involve sending partial hashes off-device; (4) OS keychain permissions are understood (the agent will need access to store/retrieve session tokens); (5) recovery wording (BIP39) and TOTP options have the expected security tradeoffs — storing TOTP in the same vault reduces security. Consider testing with non-sensitive entries first and require explicit confirmation for any medium/high/critical accesses.

Type: OpenClaw Skill Name: passwords Version: 1.1.0 The 'Passwords' skill bundle describes a robust, security-focused local credential vault. The `SKILL.md` details strong cryptographic practices (Argon2id, HKDF-SHA256, `age` encryption), secure handling of sensitive data (no command-line args, OS keychain integration, memory zeroing), and strict access control policies for the AI agent. Crucially, it includes an explicit 'What Agents Must Not Do' section, instructing the agent to avoid common insecure behaviors like logging credentials or auto-filling on domain mismatch, which actively mitigates prompt injection risks and demonstrates a strong intent for secure operation. There is no evidence of data exfiltration, malicious execution, persistence, or other harmful activities.