Encrypted local secret store for OpenClaw agents. AES-256-GCM authenticated encryption with per-secret random IVs, master key in chmod 0600 .master-key file. A PURE STORE: it encrypts, retrieves, lists, rotates, audits, and deletes secrets — it never writes plaintext secrets to disk or generates executable command scripts. Modes: --store (encrypt+write), --get (masked; --raw --confirm-expose prints plaintext to stdout), --list (names+metadata only), --delete (irreversible), --rotate and --rotate --all (generate new random values, archive old as retired), --audit / --audit --expired / --audit --stale (exposure/rotation checks), --status. Supports SECRETS_DIR and SECRETS_MASTER_KEY env overrides. For injecting secrets into shell commands, use the separate `secrets-inject` skill (high-privilege). Master key is recoverable from .master-key file; losing it makes stored secrets unrecoverable.
Memory
secrets-inject
Try itHIGH-PRIVILEGE companion to secrets-manager. Substitutes encrypted secrets into command strings and materializes them as executable shell scripts (written to chmod 0600 temp files) or prints them to stdout. This is a secret-exfiltration-capable capability by design — it intentionally expands a secret store into command material. Use ONLY when you must hand secrets to a shell command. The core secrets-manager store deliberately does NOT do this; this lives in its own skill so the dangerous capability is opt-in and clearly labeled. Requires the secrets-manager store (memory/secrets).
What it does
HIGH-PRIVILEGE companion to secrets-manager. Substitutes encrypted secrets into command strings and materializes them as executable shell scripts (written to chmod 0600 temp files) or prints them to stdout. This is a secret-exfiltration-capable capability by design — it intentionally expands a secret store into command material. Use ONLY when you must hand secrets to a shell command. The core secrets-manager store deliberately does NOT do this; this lives in its own skill so the dangerous capability is opt-in and clearly labeled. Requires the secrets-manager store (memory/secrets).
The skill document
Secrets Inject ⚠️ (HIGH PRIVILEGE)
This skill deliberately takes encrypted secrets and turns them into
executable shell commands containing plaintext secrets. It exists as a
separate, clearly-labeled skill so the core secrets-manager can stay a
pure, clean store. Only install/use this if you actually need to inject
secrets into a command.
⚠️ Why this is dangerous (read before use)
- It decrypts secrets and writes them into a plaintext temp shell
script (
/tmp/secrets-inject-*.sh, mode 0600). - Anyone who can read that temp file (same user, backups, forensic images, exfiltration) gets the plaintext secrets.
- Printing to stdout (
--inject-stdout) puts plaintext secrets into shell history, logs, journald, CI output, and terminal scrollback. - This is the canonical "secret exfiltration path" — treat it with the same
care you'd give
cat .master-key.
When you might need it
You have a secret in secrets-manager and must pass it to a command that
needs it inline (e.g. curl -H "Authorization: Bearer {{api_key}}").
Quick Start
# 1) Store the secret first (separate skill)
node skills/secrets-manager/secrets-manager.js --store api_key sk-abc123
# 2) Inject into a command → writes a temp script, prints its path
node skills/secrets-inject/secrets-inject.js --inject "curl -H 'Authorization: Bearer {{api_key}}' https://api.example.com/v1"
# Output: [secrets-inject] ✅ Injected 1 secret(s) into: /tmp/secrets-inject-12345-1.sh
# [secrets-inject] Run with: sh /tmp/secrets-inject-12345-1.sh
# 3) Run it, then CLEAN UP
sh /tmp/secrets-inject-12345-1.sh
node skills/secrets-inject/secrets-inject.js --cleanup-tmp
Print to stdout (DANGEROUS — requires explicit confirmation)
node skills/secrets-inject/secrets-inject.js --inject-stdout --confirm-expose "echo {{api_key}}"
# Will print the resolved command with the plaintext secret.
The skill refuses to print to stdout without --confirm-expose.
Cleanup
Temp injection files are tracked in memory/secrets/.tmp-injections.json
and removed by --cleanup-tmp. They are NOT auto-removed — delete them
after use. An undeleted temp file is plaintext-on-disk exposure.
Security Notes
- Temp scripts are chmod 0600 but are still plaintext on disk — the only protection is file permissions and your diligence in deleting them.
- Prefer
secrets-manager --get --raw > /tmp/k && chmod 600 /tmp/kand pass the file path to a command instead of inline injection when possible. - Never run this on a shared host, container, or CI runner you don't fully trust.
- This skill does NOT store secrets — it only reads the secrets-manager store.
What this skill does NOT do
- Does NOT store secrets (that's
secrets-manager). - Does NOT transmit secrets anywhere (it only substitutes them locally).
- Does NOT auto-clean temp files (you must run
--cleanup-tmp).
Related skills
Use Bitwarden Secrets Manager safely
Scan skills in a project directory for security issues and generate a markdown table report, then install skills from a local registry. Combines static analysis of code and markdown files with supply chain checks. Use when auditing a skills directory, generating a security summary table, or installi
Scan agent skill files for hidden instructions and prompt-injection patterns (EN/RU) before a poisoned skill rewrites your agent. 19 rules, zero dependencies. Use ONLY with the user's explicit consent: tell the user which skills folder will be scanned — findings are printed to stdout locally.
Run agent commands with secrets injected server-side — plaintext never returned, never shown in chat.
Scan agent outputs and pipeline data for exposed API keys, tokens, and credentials before they reach users or logs.