Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
- Added a new "Security" section to documentation explaining local-only, read-only behavior and detailing all restricted APIs. - Provided a self-verification guide with exact `grep` command to confirm no network, process, write, or dynamic execution capabilities exist in the script. - Clarified which Node.js modules are (and are not) used, improving transparency and trust for users.
What This Skill Does
Scans OpenClaw session JSONL files for credentials that may have been sent to AI providers. Matches credential fragments against configurable patterns and identifies which provider (Anthropic, OpenAI, Google, etc.) received the data. Distinguishes real leaks from config echoes where the config file itself was read during a session.
Runs entirely local with no network access, no dependencies, and no file writes, so it can be trusted to scan sensitive session data without risk of further exposure.
When to use it
- Checking if an API key was accidentally sent to an AI model
- Auditing past sessions after a suspected credential exposure
- Verifying no secrets leaked before sharing session logs
- Running a post-incident scan across all stored sessions
- Monitoring which AI providers received sensitive data
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: check if any of my credentials leaked in recent sessions
- 1Read leak-check.json config from ~/.openclaw/credentials/ to load credential fragments
- 2Scan all JSONL files in ~/.openclaw/agents/main/sessions/
- 3Match each session's content against configured wildcard patterns
- 4Distinguish config echoes (where config file was read) from real leaks
- 5Report matched credentials with session ID, timestamp, and provider name
Discord-formatted report listing 2 leaked credentials with session IDs and providers, or a clean confirmation if none found
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.