LaunchKit · 2026
Back to Skills

leak-check

Scan session logs for leaked credentials.

0
563 downloads
by @khaney64

Setup & Installation

openclaw skills install @khaney64/leak-check

Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:

npx clawhub install leak-check

Version History

v0.1.7Mar 3, 2026 - Version note by skill developer:

- Added a new "Security" section to documentation explaining local-only, read-only behavior and detailing all restricted APIs. - Provided a self-verification guide with exact `grep` command to confirm no network, process, write, or dynamic execution capabilities exist in the script. - Clarified which Node.js modules are (and are not) used, improving transparency and trust for users.

What This Skill Does

Scans OpenClaw session JSONL files for credentials that may have been sent to AI providers. Matches credential fragments against configurable patterns and identifies which provider (Anthropic, OpenAI, Google, etc.) received the data. Distinguishes real leaks from config echoes where the config file itself was read during a session.

Runs entirely local with no network access, no dependencies, and no file writes, so it can be trusted to scan sensitive session data without risk of further exposure.

When to use it

  • Checking if an API key was accidentally sent to an AI model
  • Auditing past sessions after a suspected credential exposure
  • Verifying no secrets leaked before sharing session logs
  • Running a post-incident scan across all stored sessions
  • Monitoring which AI providers received sensitive data

Example Workflow

Here's how your AI assistant might use this skill in practice.

INPUT

User asks: check if any of my credentials leaked in recent sessions

AGENT
  1. 1Read leak-check.json config from ~/.openclaw/credentials/ to load credential fragments
  2. 2Scan all JSONL files in ~/.openclaw/agents/main/sessions/
  3. 3Match each session's content against configured wildcard patterns
  4. 4Distinguish config echoes (where config file was read) from real leaks
  5. 5Report matched credentials with session ID, timestamp, and provider name
OUTPUT

Discord-formatted report listing 2 leaked credentials with session IDs and providers, or a clean confirmation if none found

Requirements

Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.

leak-check.json config file with credential fragments to search for