mcpField
S
secrets-hygiene

secrets-hygiene

github.com/archieindianSecurity7343 installsUpdated 26w ago
Repository

About secrets-hygiene

A security skill for auditing credentials configured in OpenClaw. It inventories secrets, flags stale or orphaned credentials, reports findings, and records audit state for scheduled checks.

Key features

  1. 01Inventories configured secrets
  2. 02Tracks skill access and rotation dates
  3. 03Flags stale and orphaned credentials
  4. 04Reports audit findings
  5. 05Stores audit state

Use cases

  1. 01Run a scheduled credential audit
  2. 02Review credentials after skill changes
  3. 03Check secrets after a suspected incident

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/archieindian/openclaw-superpowers --skill secrets-hygiene

After installing, type/secrets-hygienein Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

audit.py
example-state.yaml
STATE_SCHEMA.yaml

Details

From the project README

Secrets Hygiene

State file: ~/.openclaw/skill-state/secrets-hygiene/state.yaml

Credentials you forgot about are credentials that will leak.

When to Use

  • On Monday 9am cron wakeup
  • When adding or removing a skill that uses credentials
  • After any suspected security incident

The Audit Process

Step 1: Inventory

List all secrets currently configured in OpenClaw (env vars, config files, keychain entries referenced by installed skills). For each, record: name, which skills access it, when it was last rotated (if known).

Step 2: Flag Stale Secrets

A secret is stale if:

  • Last rotated more than 90 days ago (or unknown rotation date)
  • The skill that uses it is no longer installed
  • It grants broader access than the skill needs
Step 3: Report

Send a summary:

Secrets Audit — [date]
[N] secrets tracked
[N] flagged for rotation: [names]
[N] orphaned (skill removed): [names]
Action needed: [yes/no]
Step 4: Update State

Write last_audit_at, updated tracked_secrets list, flagged_count, orphaned_count to state file.

Cron Wakeup Behavior

On Monday 9am wakeup:

  • Read state; if last_audit_at is within the last 6 days, skip
  • Otherwise run the audit and update state

Comments

Markdown supported