Skill: callmedas69/credential-manager (version 1.3.0)

--- name: credential-manager description: MANDATORY security foundation for OpenClaw. Consolidate scattered API keys and credentials into a secure .env file with proper permissions. Use when setting up OpenClaw, migrating credentials, auditing security, or enforcing the .env standard. This is not optional — centralized credential management is a core requirement for secure OpenClaw deployments. Scans for credential files across common locations, backs up existing files, creates a unified .env with mode 600, validates security, and enforces best practices. --- # Credential Manager **STATUS: MANDATORY SECURITY FOUNDATION** Consolidate scattered API keys and credentials into a secure, centralized `.env` file. ## ⚠️ This Is Not Optional Centralized `.env` credential management is a **core requirement** for OpenClaw security. If your credentials are scattered across multiple files, **stop and consolidate them now**. **THE RULE:** All credentials MUST be in `~/.openclaw/.env` ONLY. No workspace, no skills, no scripts directories. See: - [CORE-PRINCIPLE.md](CORE-PRINCIPLE.md) - Why this is non-negotiable - [CONSOLIDATION-RULE.md](CONSOLIDATION-RULE.md) - The single source principle ## The Foundation **Every OpenClaw deployment MUST have:** ``` ~/.openclaw/.env (mode 600) ``` This is your single source of truth for all credentials. No exceptions. **Why?** - Single location = easier to secure - File mode 600 = only you can read - Git-ignored = won't accidentally commit - Validated format = catches errors - Audit trail = know what changed Scattered credentials = scattered attack surface. This skill fixes that. ## What This Skill Does 1. **Scans** for credentials in common locations 2. **Backs up** existing credential files (timestamped) 3. **Consolidates** into `~/.openclaw/.env` 4. **Secures** with proper permissions (600) 5. **Validates** security and format 6. **Enforces** best practices 7. **Cleans up** old files after migration ## Detection Parameters The skill automatically detects credentials by scanning for: **File Patterns:** - `credentials.json` files in config directories - `.env` files - Memory files with `-creds` or `credentials` in the name **Sensitive Key Patterns:** - API keys, access tokens, bearer tokens - Secrets, passwords, passphrases - OAuth consumer keys - Private keys, signing keys, wallet keys - Mnemonics and seed phrases **Security Checks:** - File permissions (must be `600`) - Git-ignore protection - Format validation ## Quick Start ### Full Migration (Recommended) ```bash # Scan for credentials ./scripts/scan.py # Review and consolidate ./scripts/consolidate.py # Validate security ./scripts/validate.py ``` ### Individual Operations ```bash # Scan only ./scripts/scan.py # Consolidate specific service ./scripts/consolidate.py --service x # Backup without removing ./scripts/consolidate.py --backup-only # Clean up old files ./scripts/cleanup.py --confirm ``` ## Common Credential Locations The skill scans these locations: ``` ~/.config/*/credentials.json ~/.openclaw/workspace/memory/*-creds.json ~/.openclaw/workspace/memory/*credentials*.json ~/.env (if exists, merges) ``` ## Security Features ✅ **File permissions:** Sets `.env` to mode 600 (owner only) ✅ **Git protection:** Creates/updates `.gitignore` ✅ **Backups:** Timestamped backups before changes ✅ **Validation:** Checks format, permissions, and duplicates ✅ **Template:** Creates `.env.example` (safe to share) ## Output Structure After migration: ``` ~/.openclaw/ ├── .env # All credentials (secure) ├── .env.example # Template (safe) ├── .gitignore # Protects .env ├── CREDENTIALS.md # Documentation └── backups/ └── credentials-old-YYYYMMDD/ # Backup of old files ``` ## Supported Services Common services auto-detected: - **X (Twitter):** OAuth 1.0a credentials - **Molten:** Agent intent matching - **Moltbook:** Agent social network - **Botchan/4claw:** Net Protocol - **OpenAI, Anthropic, Google:** AI providers - **GitHub, GitLab:** Code hosting - **Generic:** `API_KEY`, `*_TOKEN`, `*_SECRET` patterns See [references/supported-services.md](references/supported-services.md) for full list. ## Security Best Practices See [references/security.md](references/security.md) for detailed security guidelines. **Quick checklist:** - ✅ `.env` has 600 permissions - ✅ `.env` is git-ignored - ✅ No credentials in code or logs - ✅ Rotate keys periodically - ✅ Use separate keys per environment ## Scripts All scripts support `--help` for detailed usage. ### scan.py ```bash # Scan and report ./scripts/scan.py # Include custom paths ./scripts/scan.py --paths ~/.myapp/config ~/.local/share/creds # JSON output ./scripts/scan.py --format json ``` ### consolidate.py ```bash # Interactive mode (prompts before changes) ./scripts/consolidate.py # Auto-confirm (no prompts) ./scripts/consolidate.py --yes # Backup only ./scripts/consolidate.py --backup-only # Specific service ./scripts/consolidate.py --service molten ``` ### validate.py ```bash # Full validation ./scripts/validate.py # Check permissions only ./scripts/validate.py --check permissions # Fix issues automatically ./scripts/validate.py --fix ``` ### cleanup.py ```bash # Dry run (shows what would be deleted) ./scripts/cleanup.py # Actually delete old files ./scripts/cleanup.py --confirm # Keep backups ./scripts/cleanup.py --confirm --keep-backups ``` ## Migration Workflow **Step 1: Discovery** ```bash ./scripts/scan.py ``` Review output to see what will be migrated. **Step 2: Backup & Consolidate** ```bash ./scripts/consolidate.py ``` Creates backups, builds `.env`, sets permissions. **Step 3: Validation** ```bash ./scripts/validate.py ``` Ensures everything is secure and correct. **Step 4: Test** Test your applications/skills with the new `.env` file. **Step 5: Cleanup** ```bash ./scripts/cleanup.py --confirm ``` Removes old credential files (backups remain). ## For Skill Developers: Enforce This Standard Other OpenClaw skills MUST validate credentials are secure before using them: ### Python Skills ```python #!/usr/bin/env python3 import sys from pathlib import Path # Add credential-manager scripts to path sys.path.insert(0, str(Path.home() / '.openclaw/skills/credential-manager/scripts')) # Enforce secure .env (exits if not compliant) from enforce import require_secure_env, get_credential require_secure_env() # Now safe to load credentials [REDACTED_SECRET]'SERVICE_API_KEY') ``` ### Bash Skills ```bash #!/usr/bin/env bash set -euo pipefail # Validate .env exists and is secure if ! python3 ~/.openclaw/skills/credential-manager/scripts/enforce.py; then exit 1 fi # Now safe to load source ~/.openclaw/.env ``` **This creates a fail-fast system:** If credentials aren't properly secured, skills refuse to run. Users are forced to fix it. ## Loading Credentials After migration, load from `.env`: ### Python ```python import os from pathlib import Path # Load .env env_file = Path.home() / '.openclaw' / '.env' with open(env_file) as f: for line in f: if '=' in line and not line.strip().startswith('#'): key, val = line.strip().split('=', 1) os.environ[key] = val # Use credentials [REDACTED_SECRET]'SERVICE_API_KEY') ``` ### Bash ```bash # Load .env set -a source ~/.openclaw/.env set +a # Use credentials echo "$SERVICE_API_KEY" ``` ### Using Existing Loaders If you migrated using OpenClaw scripts: ```python from load_credentials import get_credentials creds = get_credentials('x') ``` ## Adding New Credentials Edit `~/.openclaw/.env`: ```bash # Add new service NEW_SERVICE_API_KEY=your_key_here NEW_SERVICE_SECRET=your_secret_here ``` Update template too: ```bash # Edit .env.example NEW_SERVICE_API_KEY=your_key_here NEW_SERVICE_SECRET=your_secret_here ``` ## Rollback If something goes wrong: ```bash # Find your backup ls -la ~/.openclaw/backups/ # Restore specific file cp ~/.openclaw/backups/credentials-old-YYYYMMDD/x-credentials.json.bak \ ~/.config/x/credentials.json ``` ## Notes - **Non-destructive by default:** Original files backed up before removal - **Idempotent:** Safe to run multiple times - **Extensible:** Add custom credential patterns in scripts - **Secure:** Never logs full credentials, only metadata


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)