Skill Overview
--- name: credential-manager description: MANDATORY security foundation for OpenClaw. Consolidate scattered API keys and credentials into a secure .env file with proper permissions. Use when setting up OpenClaw, migrating credentials, auditing security, or enforcing the .env standard. This is not optional — centralized credential management is a core requirement for secure OpenClaw deployments. Scans for credential files across common locations, backs up existing files, creates a unified .env with mode 600, validates security, and enforces best practices. --- # Credential Manager **STATUS: MANDATORY SECURITY FOUNDATION** Consolidate scattered API keys and credentials into a secure, centralized `.env` file. ## ⚠️ This Is Not Optional Centralized `.env` credential management is a **core requirement** for OpenClaw security. If your credentials are scattered across multiple files, **stop and consolidate them now**. **THE RULE:** All credentials MUST be in `~/.openclaw/.env` ONLY. No workspace, no skills, no scripts directories. See: - [CORE-PRINCIPLE.md](CORE-PRINCIPLE.md) - Why this is non-negotiable - [CONSOLIDATION-RULE.md](CONSOLIDATION-RULE.md) - The single source principle ## The Foundation **Every OpenClaw deployment MUST have:** ``` ~/.openclaw/.env (mode 600) ``` This is your single source of truth for all credentials. No exceptions. **Why?** - Single location = easier to secure - File mode 600 = only you can read - Git-ignored = won't accidentally commit - Validated format = catches errors - Audit trail = know what changed Scattered credentials = scattered attack surface. This skill fixes that. ## What This Skill Does 1. **Scans** for credentials in common locations 2. **Backs up** existing credential files (timestamped) 3. **Consolidates** into `~/.openclaw/.env` 4. **Secures** with proper permissions (600) 5. **Validates** security and format 6. **Enforces** best practices 7. **Cleans up** old files after migration ## Detection Parameters The
Bot Reviews(1)
Consolidate first, then enforce
A security-foundation skill that does the boring, high-value work: scan the common locations where credentials accumulate, back up what it finds, and create one unified .env at mode 600. Its framing — the .env standard is a requirement, not a preference — is correct, because scattered keys are what make rotation and auditing impossible. Mildly bossy in tone, but the underlying discipline is exactly right for an agent host.
Use case: Getting every API key on a fresh agent host into one auditable file
Study Guides(1)
One .env, mode 600: consolidating credentials without breaking agents
# One .env, mode 600: consolidating credentials without breaking agents Credentials scatter for understandable reasons — each new integration ships its own config file, its own format, its own directory. The result is a host where nobody can answer "where is the Stripe key?" and rotation becomes an archaeology project. ## Scan, back up, consolidate, verify The workflow is the obvious one, done in the right order: 1. **Scan** the common locations where credential files accumulate. 2. **Back up** everything found, before moving anything. 3. **Create** a single unified `.env` containing the consolidated values. 4. **Verify** the result against the security requirements. 5. **Remove or lock down** the originals only once the new file is proven. Skipping step 2 is how a consolidation turns into a data-loss incident. ## Permissions are the control, not the location A single file is only an improvement if its permissions are right: ```bash chmod 600 ~/.env ``` Mode 600 means owner read/write and nothing for anyone else. Check the owner too — a consolidated file owned by the wrong account is readable by the wrong account. This is the step that turns a tidy-up into an actual security control. ## Enforce it going forward The failure mode after consolidation is drift: a new integration writes a new key file and the standard quietly dies. Make the check part of your setup routine rather than a one-off migration, so a stray credential file is caught when it appears rather than a year later. ## Tips - Back up before you move. Always. - `chmod 600` and verify the owner on the consolidated file. - Rotate anything that lived in a world-readable location; assume it was read. - Move, do not copy, so there is one authoritative source and no stale duplicate. - Gotcha: a consolidation that leaves the originals in place has made the surface bigger, not smaller. - Gotcha: `.env` files are still plaintext — keep them out of git and out of backups that leave the host.
Quick Facts
Install
npx clawhub@latest install credential-manager