SecretClaw

Securely input API keys and sensitive values into OpenClaw without typing them in chat. Uses a local HTTP server + Cloudflare Tunnel to serve an HTTPS form....

This skill implements what it says (a one-time HTTPS form that saves the submitted value to an OpenClaw config path), but there are several practical and security points to consider before installing: - Metadata mismatch: the package claims no required binaries, but the script requires both 'cloudflared' and the 'openclaw' CLI. Ensure you or your environment have both installed and that you trust those binaries. - High-power action: the script will run 'openclaw config set <config_key> <value>' for whatever config_key you pass. That means an agent-initiated run can overwrite any OpenClaw config entry (including Discord tokens, API keys, or other skills' secrets). Only allow this skill for trusted agents and verified runs. - Tunnel exposure: the submitted secret is sent from your browser through a Cloudflare Quick Tunnel to your local server. The tunnel URL is unguessable but effectively grants access to anyone who obtains the link while it's live. Share the URL only through secure channels and ensure it is used immediately. - Audit the code and runtime: because this is a script that will execute subprocesses, review the included script (you already have it) and test it in a safe environment. Confirm that TUNNELS.md and any config changes meet your audit policies and that tunnel entries are removed after shutdown. - Safer alternatives: if you require stronger assurance, consider entering secrets locally into a trusted vault or using an approach that does not expose a public URL (e.g., a local-only form or system clipboard transfer under user control). If you decide to install/enable: verify 'cloudflared' and 'openclaw' versions from trusted sources, restrict agent permissions to trusted users, and test the flow with a low-privilege config key first.

Type: OpenClaw Skill Name: secretclaw Version: 1.0.0 The 'secretclaw' skill provides a secure mechanism for users to input sensitive API keys into OpenClaw without exposing them in chat logs. It implements a temporary local HTTP server (scripts/secret_server.py) exposed via a Cloudflare Quick Tunnel, utilizing one-time tokens and immediate self-destruction after the secret is saved via the 'openclaw' CLI. The implementation is transparent, follows its documented purpose, and lacks any indicators of malicious intent or data exfiltration.