OpenClaw Key Management Skill 🔐

A comprehensive security key management system that protects your AI assistant's credentials even if memory files are compromised.

When to Use

• - Before storing any API keys, passwords, or tokens in your OpenClaw memory files
• When you need to secure existing credentials already stored in MEMORY.md or daily logs
• For any OpenClaw deployment that handles sensitive authentication data
• When sharing your workspace with others or backing up to cloud storage

Core Features

🔒 Strong Encryption

• - AES-256-GCM authenticated encryption
• PBKDF2-HMAC-SHA256 key derivation (100,000 iterations)
• Per-credential random salts and initialization vectors
• Tamper detection with authentication tags

🧠 Memory Safety

• - Credentials exist in memory for only 30 seconds during active use
• Automatic secure zeroing of plaintext credentials
• Memory locking to prevent swapping to disk
• Runtime credential cache with automatic cleanup

📁 Separation of Concerns

• - Credentials never stored in MEMORY.md or daily log files
• Dedicated encrypted vault in INLINECODE1
• Automatic detection and blocking of credential logging attempts
• Secure references like {SECRET:api_key_name} in memory files

⚙️ Dual Security Modes

• - Convenience Mode: System key derived from machine ID + hostname (automatic decryption)
• High-Security Mode: User passphrase required at each session start
• Configurable via INLINECODE3

🛠️ Easy Management

• - CLI tool for adding, retrieving, and managing credentials
• Automatic backup system with versioned encrypted backups
• Migration tool to extract existing credentials from memory files
• Integration with OpenClaw's existing memory architecture

Installation

Prerequisites

• - OpenClaw 2026.3.13 or later
• Node.js 18+ (for encryption module)
• Standard Unix-like system (Linux/macOS)

Setup Steps

Usage

Adding Credentials

Retrieving Credentials

Integration with OpenClaw

The system automatically intercepts these references and provides the decrypted value at runtime.

Security Architecture

File Structure

Threat Model & Mitigations

Configuration Options

config/key_management.json

Migration Guide

From Existing OpenClaw Deployments

1. 1. Backup your current workspace
2. Install this skill following the installation steps
3. Run migration tool: INLINECODE5
4. Verify: Check that MEMORY.md now contains {SECRET:name} references
5. Test: Ensure your workflows still function correctly

Manual Migration

1. 1. Extract credentials from your memory files
2. Add them using: INLINECODE8
3. Replace plaintext values in memory files with INLINECODE9

Best Practices

✅ Do

• - Always use this skill for any sensitive credentials
• Regularly backup your encrypted vault
• Use high-security mode for production deployments
• Review and update your configuration periodically

❌ Don't

• - Store plaintext credentials in memory files
• Share your .secrets/ directory without encryption
• Disable memory safety features without understanding risks
• Use weak system configurations (outdated Node.js, etc.)

API Reference

Node.js Module

CLI Commands

• - init - Initialize key vault
• INLINECODE12 - Add new secret
• INLINECODE13 - Get secret value
• INLINECODE14 - List all secrets
• INLINECODE15 - Create backup
• INLINECODE16 - Migrate existing credentials

Troubleshooting

Common Issues

• - "No vault file found": Run init command first
• Decryption failures: Verify system hasn't changed (machine ID, hostname)
• Permission errors: Ensure proper file permissions on .secrets/ directory
• Memory issues: Increase Node.js memory limit if handling many credentials

Recovery Procedures

• - Lost master key (convenience mode): Restore from backup or re-migrate credentials
• Forgotten passphrase (high-security mode): No recovery possible (by design)
• Corrupted vault: Restore from latest backup in INLINECODE19

Contributing

This skill follows OpenClaw AgentSkills specification. Contributions welcome:

• - Security improvements
• Additional encryption algorithms
• Better integration with OpenClaw core
• Documentation enhancements

License

MIT License - Free to use, modify, and distribute.