credential-vaultEncrypted credential storage for OpenClaw agents. Stop storing API keys in plaintext.
Install via ClawdBot CLI:
clawdbot install chloepark85/credential-vaultGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
$OPENAICalls external URL not in known-safe list
https://openclaw.comAI Analysis
The skill's stated purpose is local credential encryption and management, which aligns with the external API call to openclaw.com (likely for license/update checks). No evidence suggests credential exfiltration, hidden instructions, or obfuscation. The primary risk is the standard threat of local keyloggers or memory inspection while the vault is unlocked, inherent to any local password manager.
Audited Apr 17, 2026 · audit v1.0
Generated May 5, 2026
An AI agency operates multiple agents that call various APIs (OpenAI, Tavily, etc.). Instead of scattering keys in .env files, they use Credential Vault to centrally store and inject keys via env export, with audit logging to track which agent accessed which key.
A fintech startup uses automated scripts to pull market data and execute trades. Credential Vault encrypts exchange API keys and tokens, and its expiry tracking ensures keys are rotated before expiration, meeting compliance requirements.
A cloud infrastructure team uses a shared machine for deployment scripts. The vault prevents accidental leaks by requiring a session unlock before deployment tools access cloud provider secrets, and the audit log provides accountability.
A developer wants to store personal tokens (GitHub, npm, Docker Hub) securely without a full password manager. They use the vault with tag-based organization, and lock it when not needed, protecting secrets from casual browsing.
A research lab runs multiple OpenClaw agents that each need distinct credentials (e.g., PubMed API, arXiv API). The vault's tag-based env injection allows each skill to pull only its required credentials, simplifying configuration and reducing risk.
The vault is open-source (MIT-0) to gain community adoption. Revenue comes from offering enterprise support, custom integrations, and security audits for companies that need guaranteed uptime and compliance.
Offer a cloud-hosted version with multi-user access, backup, and sync across machines. This adds convenience for teams while maintaining encryption. Revenue from monthly subscriptions based on number of users and secrets.
Provide consulting services to organizations adopting AI agents, helping them integrate the vault into their workflows, set up best practices, and train their teams. This leverages the vault as a gateway for broader security consulting.
💬 Integration Tip
Integrate by adding `eval $(uv run vault env --tag <skill>)` before skill execution in your scripts or Makefile. For Python skills, use `from lib.store import Store` and call `store.get()` after ensuring the vault is unlocked.
Scored Jun 29, 2026
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...
全面排查企业的经营风险情况,适用于供应商准入尽调、贷前风险筛查、合作伙伴背景调查等场景,全方位预警潜在经营风险,辅助决策者规避合作隐患。
Security scanner for AI agent skills. 9 built-in detection signatures. Identifies secrets, unsafe execution patterns, and prompt injection. Sub-50ms results.
Wallet anti-theft guard. One-click scan for high-risk wallet approvals to protect user assets. Use when a user asks for a wallet security check, wallet healt...
Comprehensive security audit for an agent's full skill stack. Chains scanner, differ, trust-verifier, and health-monitor into a single assessment with priori...
Audit and score OpenClaw AgentSkills against structural compliance, quality standards, and OpenClaw-specific architecture patterns. Produces a 0-100 score wi...