메뉴
Scans OpenClaw config directories for plaintext API keys, tokens, and secrets in unencrypted files — flags exposure risks and suggests encryption or environment variable migration.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Handles PR review feedback by fetching comments, grouping issues, fixing one group at a time, and verifying before replies.
Reviews whether a skill will trigger reliably, guide useful behavior, avoid overlap, and produce testable outcomes.
Diagnoses OpenClaw provider, fallback, channel, MCP, and gateway config issues with read-only scans and stateful summaries.
Tracks required validation gates, records pass/fail/waived results, and reports readiness before task completion.
YAML-based delegation grant ledger — issues, validates, and tracks scoped permission grants for sub-agent expansions with token budgets and auto-expiry.
Walks the memory DAG to recall detailed context on demand — query, expand, and assemble cited answers from hierarchical summaries without re-reading raw transcripts.
| name | config-encryption-auditor |
| version | 1.0 |
| category | openclaw-native |
| description | Scans OpenClaw config directories for plaintext API keys, tokens, and secrets in unencrypted files — flags exposure risks and suggests encryption or environment variable migration. |
| stateful | true |
| cron | 0 9 * * 0 |
OpenClaw stores configuration in ~/.openclaw/ — API keys, channel tokens, provider credentials. By default, these are plaintext YAML or JSON files readable by any process on your machine.
OpenLobster solved this with AES-GCM encrypted config files. We can't change OpenClaw's config format, but we can audit it — scanning for exposed secrets, flagging unencrypted credential files, and suggesting migrations to environment variables or encrypted vaults.
| Check | Severity | What it detects |
|---|---|---|
| PLAINTEXT_API_KEY | CRITICAL | API key patterns in config files (sk-, AKIA, ghp_, etc.) |
| PLAINTEXT_TOKEN | HIGH | OAuth tokens, bearer tokens, passwords in config |
| WORLD_READABLE | HIGH | Config files with 644/755 permissions (readable by all users) |
| NO_GITIGNORE | MEDIUM | Config directory not gitignored (risk of committing secrets) |
| ENV_AVAILABLE | INFO | Secret could be migrated to environment variable |
python3 audit.py --scan # Full audit
python3 audit.py --scan --critical-only # CRITICAL findings only
python3 audit.py --fix-permissions # chmod 600 on config files
python3 audit.py --suggest-env # Print env var migration guide
python3 audit.py --status # Last audit summary
python3 audit.py --format json
Step 1 — Run the audit
python3 audit.py --scan
Step 2 — Fix CRITICAL issues first
For each PLAINTEXT_API_KEY finding, migrate the key to an environment variable:
# Instead of storing in config.yaml:
# api_key: sk-abc123...
# Use:
export OPENCLAW_API_KEY="sk-abc123..."
Step 3 — Fix file permissions
python3 audit.py --fix-permissions
This sets chmod 600 on all config files (owner read/write only).
Step 4 — Verify gitignore coverage
Ensure ~/.openclaw/ or at minimum the config files are in your global .gitignore.
Audit results and history stored in ~/.openclaw/skill-state/config-encryption-auditor/state.yaml.
Fields: last_audit_at, findings, files_scanned, audit_history.