openclaw-credential-encryption
Encrypts OpenClaw runtime credentials using macOS Keychain and FileVault for enhanced security and protection against plaintext storage.
Install this skill
Security score
The openclaw-credential-encryption skill was audited on Mar 8, 2026 and we found 63 security issues across 2 threat categories, including 6 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Access to hidden dotfiles in home directory
| 3 | description: Encrypt OpenClaw runtime credentials with macOS Keychain integration, FileVault enforcement, and comprehensive protection for ~/.clawdbot/ directory and OAuth materials. |
Access to hidden dotfiles in home directory
| 38 | echo "DISCORD_TOKEN=abc123" > ~/.env |
Access to hidden dotfiles in home directory
| 39 | echo "API_KEY=sk-proj-xyz" >> ~/.env |
Access to hidden dotfiles in home directory
| 47 | # Secure ~/.clawdbot/ directory |
Access to hidden dotfiles in home directory
| 48 | chmod 700 ~/.clawdbot/ |
Access to hidden dotfiles in home directory
| 49 | chmod 600 ~/.clawdbot/credentials/* |
Access to hidden dotfiles in home directory
| 50 | chmod 600 ~/.clawdbot/sessions/* |
Access to hidden dotfiles in home directory
| 51 | chmod 600 ~/.clawdbot/oauth.json |
Access to hidden dotfiles in home directory
| 54 | chflags schg ~/.clawdbot/credentials/ |
Access to hidden dotfiles in home directory
| 95 | # Scan ~/.clawdbot/ directory |
Access to hidden dotfiles in home directory
| 96 | if [ -d ~/.clawdbot ]; then |
Access to hidden dotfiles in home directory
| 97 | echo "📁 ~/.clawdbot/ directory found:" |
Access to hidden dotfiles in home directory
| 98 | find ~/.clawdbot/ -type f -exec ls -la {} \; 2>/dev/null |
Access to hidden dotfiles in home directory
| 102 | grep -r "api[_-]?key\|password\|secret\|token" ~/.clawdbot/ 2>/dev/null || echo "✅ No plaintext secrets found" |
Access to hidden dotfiles in home directory
| 104 | echo "✅ ~/.clawdbot/ directory not found" |
Access to hidden dotfiles in home directory
| 139 | if [ -d ~/.clawdbot/credentials ]; then |
Access to hidden dotfiles in home directory
| 140 | cp -r ~/.clawdbot/credentials ~/.clawdbot/credentials.backup.$(date +%Y%m%d) |
Access to hidden dotfiles in home directory
| 145 | if [ -f ~/.clawdbot/credentials/discord ]; then |
Access to hidden dotfiles in home directory
| 146 | DISCORD_TOKEN=$(cat ~/.clawdbot/credentials/discord) |
Access to hidden dotfiles in home directory
| 148 | rm ~/.clawdbot/credentials/discord |
Access to hidden dotfiles in home directory
| 153 | if [ -f ~/.env ]; then |
Access to hidden dotfiles in home directory
| 154 | grep "ANTHROPIC_API_KEY" ~/.env && { |
Access to hidden dotfiles in home directory
| 155 | API_KEY=$(grep "ANTHROPIC_API_KEY" ~/.env | cut -d'=' -f2) |
Access to hidden dotfiles in home directory
| 157 | sed -i '' '/ANTHROPIC_API_KEY/d' ~/.env |
Access to hidden dotfiles in home directory
| 260 | if grep -r "api[_-]?key\|password\|secret\|token" ~/.clawdbot/ 2>/dev/null; then |
Access to .env file
| 38 | echo "DISCORD_TOKEN=abc123" > ~/.env |
Access to .env file
| 39 | echo "API_KEY=sk-proj-xyz" >> ~/.env |
Access to .env file
| 115 | find ~ -name ".env*" -exec grep -l "claw\|openclaw" {} \; 2>/dev/null || echo "✅ No OpenClaw env files found" |
Access to .env file
| 153 | if [ -f ~/.env ]; then |
Access to .env file
| 154 | grep "ANTHROPIC_API_KEY" ~/.env && { |
Access to .env file
| 155 | API_KEY=$(grep "ANTHROPIC_API_KEY" ~/.env | cut -d'=' -f2) |
Access to .env file
| 157 | sed -i '' '/ANTHROPIC_API_KEY/d' ~/.env |
Access to .env file
| 198 | # .env.template for OpenClaw |
Access to .env file
| 199 | # Copy to .env.local and fill with Keychain references |
Access to system keychain/keyring
| 3 | description: Encrypt OpenClaw runtime credentials with macOS Keychain integration, FileVault enforcement, and comprehensive protection for ~/.clawdbot/ directory and OAuth materials. |
Access to system keychain/keyring
| 20 | ### 1. macOS Keychain Integration |
Access to system keychain/keyring
| 25 | # Store credentials in macOS Keychain |
Access to system keychain/keyring
| 79 | #### Keychain Alternative for OAuth |
Access to system keychain/keyring
| 82 | # Store OAuth tokens in Keychain |
Access to system keychain/keyring
| 118 | ### Keychain Verification |
Access to system keychain/keyring
| 121 | # Verify Keychain credentials |
Access to system keychain/keyring
| 122 | echo "=== Keychain Credential Verification ===" |
Access to system keychain/keyring
| 123 | security find-generic-password -a "openclaw" -s "discord_token" -g 2>/dev/null && echo "✅ Discord token in Keychain" || echo "❌ Discord token not in Keychain" |
Access to system keychain/keyring
| 124 | security find-generic-password -a "openclaw" -s "anthropic_api_key" -g 2>/dev/null && echo "✅ Anthropic API key in Keychain" || echo "❌ Anthropic API key not in Keychain" |
Access to system keychain/keyring
| 125 | security find-generic-password -a "openclaw" -s "twilio_auth_token" -g 2>/dev/null && echo "✅ Twilio token in Keychain" || echo "❌ Twilio token not in Keychain" |
Access to system keychain/keyring
| 130 | ### Migrate to Keychain |
Access to system keychain/keyring
| 134 | # migrate-credentials-to-keychain.sh |
Access to system keychain/keyring
| 136 | echo "🔐 Migrating OpenClaw credentials to macOS Keychain..." |
Access to system keychain/keyring
| 149 | echo "✅ Migrated Discord token to Keychain" |
Access to system keychain/keyring
| 158 | echo "✅ Migrated Anthropic API key to Keychain" |
Access to system keychain/keyring
| 189 | # Configure OpenClaw to use Keychain |
Access to system keychain/keyring
| 190 | openclaw config set security.credential_storage="keychain" |
Access to system keychain/keyring
| 199 | # Copy to .env.local and fill with Keychain references |
Access to system keychain/keyring
| 201 | # Discord (stored in Keychain) |
Access to system keychain/keyring
| 202 | # DISCORD_TOKEN=keychain://openclaw/discord_token |
Access to system keychain/keyring
| 204 | # Anthropic API (stored in Keychain) |
Access to system keychain/keyring
| 205 | # ANTHROPIC_API_KEY=keychain://openclaw/anthropic_api_key |
Access to system keychain/keyring
| 207 | # Twilio (stored in Keychain) |
Access to system keychain/keyring
| 208 | # TWILIO_AUTH_TOKEN=keychain://openclaw/twilio_auth_token |
Access to system keychain/keyring
| 209 | # TWILIO_ACCOUNT_SID=keychain://openclaw/twilio_account_sid |
Access to system keychain/keyring
| 216 | - Store credentials in macOS Keychain |
Access to system keychain/keyring
| 240 | # Monitor Keychain access |
Access to system keychain/keyring
| 241 | log stream --predicate 'subsystem == "com.apple.security"' | grep keychain |
Install this skill with one command
/learn @hummbl-dev/openclaw-credential-encryption