credential-exposure-map

Credential Exposure Map

See every credential your agent can touch. Score the blast radius. Shrink the attack surface.

When to Activate

• User says: "credential audit", "exposure map", "security audit"
• User says: "what can my agent access", "credential scan"
• User says: "credential cleanup", "redact credentials"

Do NOT activate for normal work conversations.

Audit Flow

When user asks for a credential audit or exposure map:

1. Run the scanner:

python3 skills/credential-exposure-map/scripts/scan_exposure.py

1. Present the output in a clean format:

   • Summary: total findings, risk distribution
   • Credential Inventory: table with preview, risk level, source, location
   • Skill Capability Matrix: which skills have exec/read/network/write
   • Top recommendations for reducing exposure

2. Highlight CRITICAL findings prominently.

Recommendation Generation

After presenting the scan, offer specific recommendations:

• CRITICAL credentials in env: "Move to secrets vault or remove from agent context"
• Credentials in MEMORY.md: "These persist across sessions. Consider redacting."
• Skills with full exec+network: "Review if this skill needs both capabilities"
• Secrets in git history: "Use git filter-branch or BFG to scrub history"
• MCP servers with auth: "Verify each MCP server's permission scope"

Output Format

Summary

Scan Complete: X finding(s)
Risk: N Critical | N High | N Medium | N Low

Credential Inventory

Table showing each credential with:

• Preview (first 8 chars + ***)
• Risk level (CRITICAL/HIGH/MEDIUM/LOW)
• Source (env/config/memory/skill/mcp/git)
• Location (file:line or config path)

Skill Capability Matrix

Table showing each installed skill with exec/read/network/write permissions and risk score.

Security Considerations

• NEVER output full credential values. Always mask as first8chars***
• Report is saved to ~/.openclaw/credential-exposure-report.json with 600 permissions
• Scan is read-only, does not modify any files
• Skill capability inference is conservative (assumes exec = full filesystem access)

Detection Coverage