Secure API Calls

Call any API without leaking credentials. Keychains proxies requests and injects real tokens server-side — your agent never sees them.

This skill appears internally consistent: it installs the Keychains CLI via npm and instructs the agent to route API calls through keychains.dev using placeholder tokens. Before installing, verify you trust the Keychains service and the npm package maintainer (review the package source, maintainers, and recent versions). Understand that the CLI will create a local keypair (~/.keychains/) and that full request metadata (URL, headers, body) will be proxied to keychains.dev — only placeholders are meant to contain secrets, but accidental inclusion of real secrets in other parts of a request would expose them to the proxy. If you require higher assurance, review the keychains npm package code, audit network traffic during a test run, pin the package version, and confirm the Keychains privacy/security documentation and ownership. Also note user-invocable:false and that autonomous model invocation is allowed by default — if you do not want an agent to call this skill without explicit user action, disable model invocation or avoid installing the skill.

Type: OpenClaw Skill Name: secure-api-calls Version: 1.0.3 The skill is classified as suspicious due to its reliance on installing a global npm package (`[email protected]`) and the local generation of an Ed25519 SSH keypair in `~/.keychains/` by the `keychains` CLI, as detailed in `SKILL.md`. While the skill's stated purpose is to enhance security by abstracting credentials via a proxy service (`keychains.dev`), these operations introduce significant supply chain risks and trust requirements. If the `keychains` package or the `keychains.dev` service were compromised, it could lead to unauthorized access or credential leakage, despite the skill's explicit claims of security and privacy.