Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
- Setup instructions now include explicitly sending the QR image (qr.png) to the user and deleting it immediately for better security. - Google Authenticator/Authy configuration step updated to allow using either the generated secret or QR image.
What This Skill Does
Adds TOTP-based two-factor verification before an agent executes sensitive operations. Uses otplib with a 2-window tolerance (±1 minute) to handle clock drift. Requires a one-time setup with any TOTP authenticator app.
Enforces a hardware-independent second factor at the agent level without modifying the underlying service or infrastructure.
When to use it
- Gating access to .env file contents
- Requiring OTP before restarting a gateway service
- Confirming identity before deleting backups
- Protecting critical config file reads
- Blocking external API key operations without verification
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: delete the staging backup
- 1Agent prompts user for a 6-digit OTP from their authenticator app
- 2User provides the code
- 3Agent runs: TOTP_SECRET=$TOTP_SECRET node scripts/verify.js 123456
- 4Script exits 0 if valid, 1 if invalid or expired
- 5Agent proceeds with deletion on exit 0, denies on exit 1
Backup deleted after successful OTP verification, or access denied with no action taken
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.