Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Release v1.5.0. See https://github.com/0-Vault/Vault-0/releases/tag/v1.5.0
What This Skill Does
Vault-0 encrypts API keys with AES-256-GCM and injects them ephemerally at agent launch. It monitors agent activity in real time via WebSocket and can enforce security policies through a local proxy. Includes an optional EVM wallet for x402 micropayments, with private keys stored exclusively in macOS Keychain.
Unlike environment variable managers or secret scanning tools, Vault-0 combines encrypted storage, real-time behavioral monitoring, and policy enforcement in a single local app with no external network calls after install.
When to use it
- Encrypting plaintext API keys currently stored in .env files
- Watching agent tool calls and thinking states as they happen
- Blocking agent requests to unauthorized domains
- Auditing agent actions with exportable SHA-256 receipts
- Handling machine-to-machine micropayments without exposing wallet keys
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: secure my OpenClaw agent's API keys and enable real-time monitoring
- 1Check macOS version meets 12+ requirement
- 2Download and verify the DMG from GitHub releases
- 3Install Vault-0.app to /Applications and launch it
- 4Guide user through Secure My Agent flow to set master passphrase and run Harden Now
- 5Verify ~/.openclaw/.env first line reads # Managed by Vault-0
API keys are encrypted in the AES-256-GCM vault, injected ephemerally at launch, and the Monitor tab shows live agent activity
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.