Secret Manager

Manage API keys securely via GNOME Keyring and inject them into OpenClaw config.

This skill appears to do what it says: it uses libsecret (secret-tool) to store secrets and then updates OpenClaw config and the systemd user environment so the gateway can use them. Before installing/running, consider: 1) The script will write some keys into auth-profiles.json (plaintext in a config file) — back up that file and be aware of persistence risk. 2) It may source a .env file (SECRETS_ENV_FILE) and imports env vars into systemd user environment; that can make secrets visible to other user services. 3) It will stop/start the openclaw-gateway.service and run pkill inside a distrobox if present — this can be disruptive. 4) Confirm you trust the included script (review it line-by-line) and ensure secret-tool, python3, and systemctl user services behave as expected on your system. If you need stronger guarantees, consider modifying the script to avoid persisting secrets into JSON or avoid importing secrets into systemd environment.

Type: OpenClaw Skill Name: secret-manager Version: 1.0.0 The skill bundle is classified as benign. The `secret-manager.sh` script's actions, including storing API keys via `secret-tool`, modifying `auth-profiles.json` with Python, importing environment variables to systemd, and restarting the OpenClaw gateway service (including aggressive `pkill -9` within a Distrobox container), are all directly aligned with its stated purpose of securely managing API keys for OpenClaw. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts in `SKILL.md` beyond the legitimate scope of the skill.