Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Canary scans your OpenClaw environment for leaked secrets, including API keys, tokens, passwords, and credentials left in config files, installed skills, shell history, and local directories. It runs a silent check on every startup and a full deep scan on demand, then offers to fix any issues it finds with your confirmation.
Unlike one-time audit scripts, Canary runs automatically on every startup, covers 30+ secret formats across dozens of file locations, and applies fixes directly rather than just reporting problems.
When to use it
- Catching an API key accidentally pasted into terminal history
- Finding hardcoded credentials in a skill before publishing it
- Auditing .env file permissions on a shared or multi-user machine
- Locating credential files left in Downloads or Desktop folders
- Checking a workspace for secrets committed to a git repo
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Am I leaking any secrets?
- 1Announces a full secrets scan is starting
- 2Scans .env files, installed skill directories, shell history, SSH keys, cloud credential files, git repos, and local directories like Downloads and Desktop
- 3Groups findings by severity: critical (action needed), moderate (heads up), and clean
- 4Presents each finding in plain language with the real-world risk and an offer to fix it
- 5Summarizes total issues found with counts by severity
A severity-grouped report of exposed secrets, each with a plain-language explanation and a one-step fix offer, followed by a summary such as '3 issues found: 1 critical, 2 moderate. Everything else looks good.'