OpenClaw API Security Skill

Secure API key management and protection guidelines for OpenClaw skills

🚨 Why This Skill Exists

On February 10, 2026, we discovered a critical security issue:

• API keys were hardcoded in documentation
• Plaintext secrets were committed to version control
• Risk of public exposure on GitHub

This skill provides comprehensive security practices to prevent these issues.

🔒 Core Security Principles

Absolute DON'Ts

1. ❌ NEVER hardcode API keys in code
2. ❌ NEVER include plaintext keys in documentation
3. ❌ NEVER commit key files to version control
4. ❌ NEVER log full keys in output

Must DOs

1. ✅ Use environment variables for key management
2. ✅ Use external config files (protected by .gitignore)
3. ✅ Provide secure configuration instructions
4. ✅ Implement key rotation mechanisms

📦 What's Included

1. Security Configuration Template (config_template.py)

from api_security import SecureConfig

config = SecureConfig()
api_key = config.get_api_key("alpha_vantage")
# Returns key from env var or secure file

2. Security Scanner (security_scanner.py)

python security_scanner.py .  # Scan current directory
python security_scanner.py --output report.txt  # Save report

3. Complete Documentation (SKILL.md)

• Security best practices
• Configuration examples
• Emergency response procedures

4. Security Checklists

• Pre-commit checks
• Skill creation checklist
• Git safety guidelines

🚀 Quick Start

Installation

# Clone this skill
git clone https://github.com/ZanderH-code/openclaw-api-security.git

# Or install via ClawHub (coming soon)
openclaw skill install api-security

Basic Usage

from api_security import SecureConfig

# Initialize
config = SecureConfig()

# Get API key safely
key = config.get_api_key("openai", env_var="OPENAI_API_KEY")

# Create secure key file
config.create_key_file("alpha_vantage", "your_key_here")

# Check key safety
warnings = config.check_key_safety("test_key", "weak123")

Security Scanning

# Scan for exposed credentials
python security_scanner.py /path/to/skill

# Scan with JSON output
python security_scanner.py --format json --output findings.json

# Exit code indicates security issues
echo $?  # 0 = safe, 1 = security issues found

📋 Security Checklists

When Creating a New Skill

• No API_KEY = "plaintext" in code
• No plaintext keys in documentation
• .gitignore file configured
• Environment variable instructions provided
• External file configuration instructions provided
• Secure key loading tested

Before Git Commit

# Check for sensitive information
grep -r "API_KEY\|PASSWORD\|SECRET" . --include="*.py" --include="*.md"

# Check .gitignore effectiveness
git status --ignored

# Run security scanner
python security_scanner.py .

🛡️ Configuration Examples

Environment Variables (Recommended)

export ALPHA_VANTAGE_API_KEY=your_key_here
export OPENAI_API_KEY=your_key_here
export GITHUB_TOKEN=your_key_here

External Key Files

# Create secure key file
mkdir -p ~/.openclaw/secure
echo "your_key_here" > ~/.openclaw/secure/alpha_vantage.key
chmod 600 ~/.openclaw/secure/alpha_vantage.key  # Owner read/write only

.env File (with .gitignore)

# .env file (add to .gitignore)
API_KEY=your_key_here
DATABASE_URL=your_database_url

# .gitignore must contain:
.env
*.key
*.secret
config/secret*.json

🔍 Security Scanner Features

Detection Capabilities

• Hardcoded API keys in Python/JSON/YAML files
• Plaintext passwords in documentation
• Credentials in URLs (with auth)
• Test/demo keys with warnings

Safe Placeholders (Allowed)

• your_api_key_here
• YOUR_API_KEY
• API_KEY_PLACEHOLDER
• replace_with_your_key
• your_secret_here

Risk Classification

• HIGH RISK: Production keys, real credentials
• LOW RISK: Test/demo keys, placeholders

🚨 Emergency Response

If You Discover a Leaked Key

1. Immediate Key Rotation - Reset at service provider
2. Review Commit History - Determine exposure scope
3. Revoke Access - If possible
4. Monitor for Abuse - Watch API usage patterns
5. Update Documentation - Remove all plaintext keys

Preventive Measures

1. Regular Key Rotation - Every 90 days
2. Principle of Least Privilege - Grant only necessary permissions
3. Use Key Aliases - For easier management and revocation
4. Enable Audit Logs - Record all API calls

📚 Related Resources

Best Practices

• OWASP API Security Top 10
• GitHub Secret Scanning
• 12 Factor App Config

Security Tools

• git-secrets
• gitleaks
• truffleHog

🤝 Contributing

Security Issues

If you discover a security vulnerability:

1. DO NOT create a public issue
2. Email: security@example.com
3. Include details and steps to reproduce

Feature Requests & Bugs

• Create an issue on GitHub
• Include detailed description
• Provide reproduction steps if applicable

📄 License

This skill is released under the MIT License. See LICENSE file for details.

📞 Support

• GitHub Issues: open issues
• OpenClaw Discord: community support

---

Created: February 10, 2026
Last Updated: February 10, 2026
Maintainer: ZanderH-code
Status: Actively Maintained ✅