credential-manager
Centralizes API keys and credentials into a secure .env file for OpenClaw, enhancing security and simplifying management.
Install this skill
Security score
The credential-manager skill was audited on Feb 9, 2026 and we found 43 security issues across 1 threat category. Review the findings below before installing.
Categories Tested
Security Issues
Access to hidden dotfiles in home directory
| 16 | **THE RULE:** All credentials MUST be in `~/.openclaw/.env` ONLY. No workspace, no skills, no scripts directories. |
Access to hidden dotfiles in home directory
| 26 | ~/.openclaw/.env (mode 600) |
Access to hidden dotfiles in home directory
| 44 | 3. **Consolidates** into `~/.openclaw/.env` |
Access to hidden dotfiles in home directory
| 107 | ~/.config/*/credentials.json |
Access to hidden dotfiles in home directory
| 108 | ~/.openclaw/workspace/memory/*-creds.json |
Access to hidden dotfiles in home directory
| 109 | ~/.openclaw/workspace/memory/*credentials*.json |
Access to hidden dotfiles in home directory
| 110 | ~/.env (if exists, merges) |
Access to hidden dotfiles in home directory
| 126 | ~/.openclaw/ |
Access to hidden dotfiles in home directory
| 170 | ./scripts/scan.py --paths ~/.myapp/config ~/.local/share/creds |
Access to hidden dotfiles in home directory
| 272 | if ! python3 ~/.openclaw/skills/credential-manager/scripts/enforce.py; then |
Access to hidden dotfiles in home directory
| 277 | source ~/.openclaw/.env |
Access to hidden dotfiles in home directory
| 307 | source ~/.openclaw/.env |
Access to hidden dotfiles in home directory
| 323 | Edit `~/.openclaw/.env`: |
Access to hidden dotfiles in home directory
| 343 | ls -la ~/.openclaw/backups/ |
Access to hidden dotfiles in home directory
| 346 | cp ~/.openclaw/backups/credentials-old-YYYYMMDD/x-credentials.json.bak \ |
Access to hidden dotfiles in home directory
| 347 | ~/.config/x/credentials.json |
Access to .env file
| 3 | description: MANDATORY security foundation for OpenClaw. Consolidate scattered API keys and credentials into a secure .env file with proper permissions. Use when setting up OpenClaw, migrating credent |
Access to .env file
| 10 | Consolidate scattered API keys and credentials into a secure, centralized `.env` file. |
Access to .env file
| 14 | Centralized `.env` credential management is a **core requirement** for OpenClaw security. If your credentials are scattered across multiple files, **stop and consolidate them now**. |
Access to .env file
| 16 | **THE RULE:** All credentials MUST be in `~/.openclaw/.env` ONLY. No workspace, no skills, no scripts directories. |
Access to .env file
| 26 | ~/.openclaw/.env (mode 600) |
Access to .env file
| 44 | 3. **Consolidates** into `~/.openclaw/.env` |
Access to .env file
| 56 | - `.env` files |
Access to .env file
| 110 | ~/.env (if exists, merges) |
Access to .env file
| 115 | ✅ **File permissions:** Sets `.env` to mode 600 (owner only) |
Access to .env file
| 119 | ✅ **Template:** Creates `.env.example` (safe to share) |
Access to .env file
| 127 | ├── .env # All credentials (secure) |
Access to .env file
| 128 | ├── .env.example # Template (safe) |
Access to .env file
| 129 | ├── .gitignore # Protects .env |
Access to .env file
| 154 | - ✅ `.env` has 600 permissions |
Access to .env file
| 155 | - ✅ `.env` is git-ignored |
Access to .env file
| 227 | Creates backups, builds `.env`, sets permissions. |
Access to .env file
| 236 | Test your applications/skills with the new `.env` file. |
Access to .env file
| 257 | # Enforce secure .env (exits if not compliant) |
Access to .env file
| 271 | # Validate .env exists and is secure |
Access to .env file
| 277 | source ~/.openclaw/.env |
Access to .env file
| 284 | After migration, load from `.env`: |
Access to .env file
| 291 | # Load .env |
Access to .env file
| 292 | env_file = Path.home() / '.openclaw' / '.env' |
Access to .env file
| 305 | # Load .env |
Access to .env file
| 307 | source ~/.openclaw/.env |
Access to .env file
| 323 | Edit `~/.openclaw/.env`: |
Access to .env file
| 332 | # Edit .env.example |