Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
- Added a metadata section describing compatibility requirements: pass, gpg, openssl, python3, qrencode, and local HTTPS network access. - No other changes to workflow or logic.
What This Skill Does
Manages credential handling for AI agents by collecting secrets through one-time local HTTPS forms and storing them in pass (passwordstore). Commands run with secrets injected as environment variables via a wrapper script. Raw values never appear in chat context, logs, or commit history.
Unlike passing secrets inline or via dotenv files, collection and injection happen entirely through dedicated scripts, so raw values never touch chat transcripts, command logs, or repo files.
When to use it
- Providing an API key to an agent without typing it in chat
- Storing AWS credentials for automated deployment scripts
- Collecting a secret from a phone over LAN with TOTP verification
- Rotating a service token in the local vault without re-exposing it
- Running authenticated CLI tools without leaking credentials into shell history
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Run a script that needs my OpenAI API key
- 1Check vault: scripts/vault.sh exists openai/prod/api_key
- 2Secret missing, launch intake form: scripts/get_password_from_user.py --secretname openai/prod/api_key --port 8443
- 3Send generated HTTPS URL to user; user submits key via browser form
- 4Confirm secret is now stored in vault
- 5Execute command: scripts/run_with_secret.sh --secret openai/prod/api_key --env OPENAI_API_KEY -- python3 my_script.py
Script runs with OPENAI_API_KEY injected; secret never appears in chat or logs
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.