Menu
Add a new secret to the OpenClaw keychain and update the appropriate launcher/secrets script
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Basé sur la classification professionnelle SOC
Add a messaging channel binding (Telegram, Slack, WhatsApp, or GChat) to an existing OpenClaw agent
Create a new scheduled cron job for an OpenClaw agent (recurring, interval, or one-shot)
Scaffold a new deterministic shell script for an OpenClaw agent with JSON output, error handling, and the json-response library
Set up nightly dream routine (memory distillation) for an OpenClaw agent including DREAM-ROUTINE.md, cron job, and archive pipeline
Create a new OpenClaw agent with all required directive files, directory structure, and config registration
Restart OpenClaw gateway(s) — handles stow conflicts and verifies channels reconnect. Supports single-gateway and multi-gateway (per-tier) deployments.
| name | openclaw-add-secret |
| description | Add a new secret to the OpenClaw keychain and update the appropriate launcher/secrets script |
Add a new secret with keychain service $0 and environment variable $1.
Read ~/.openclaw/workspace/skills/06-security-model.md for the full security model.
OPENCLAW_REPO=$(readlink ~/.openclaw/openclaw.json 2>/dev/null | sed 's|/.openclaw/openclaw.json||')
TIER_CONFIGS=(~/.openclaw/configs/openclaw-*.json)
[[ -f "${TIER_CONFIGS[0]}" ]] && MULTI_GATEWAY=true || MULTI_GATEWAY=false
Ask the user for the secret value. Do NOT echo it back after they provide it.
Determine tier (multi-gateway only): Ask the user which tier this secret belongs to. List available tiers:
for cfg in ~/.openclaw/configs/openclaw-*.json; do
basename "$cfg" | sed 's/openclaw-//;s/.json//'
done
security add-generic-password -s "$0" -a "openclaw" -w "<VALUE>" ~/.openclaw/openclaw.keychain-db
openclaw-<tier>-<service-name> (lowercase, hyphens)OPENCLAW_<SERVICE_NAME> (uppercase, underscores)openclaw.<service-name> (lowercase, hyphens)OPENCLAW_<SERVICE_NAME> (uppercase, underscores)Add export line to the tier's launcher script at $OPENCLAW_REPO/.openclaw/scripts/start-<tier>.sh (before the exec block):
export $1=$(kc "$0")
The launcher script uses a kc() helper to read from keychain. Follow the existing pattern in the file.
Add export line to $OPENCLAW_REPO/.openclaw/scripts/openclaw-secrets.sh (before the exec block):
export $1=$(security find-generic-password -s "$0" -w "$KC")
$OPENCLAW_REPO/.openclaw/scripts/openclaw-env.sh:export $1=$(security find-generic-password -s "$0" -w "$KC" 2>/dev/null)
Note: openclaw-env.sh uses 2>/dev/null on all lookups for silent failure.
$OPENCLAW_REPO/secrets.sh:"$0|$1|<description>"
rm -f ~/.openclaw/cron/jobs.json
cd "$OPENCLAW_REPO" && stow --no-folding -t ~ .
launchctl kickstart -k gui/$(id -u)/ai.openclaw.gateway.<tier>
launchctl kickstart -k gui/$(id -u)/ai.openclaw.gateway
bash ~/.openclaw/scripts/start-<tier>.sh printenv "$1" | wc -c
For single-gateway:
source ~/.openclaw/scripts/openclaw-env.sh && printenv "$1" | wc -c
Should output a non-zero character count.