What problem does it solve? Adding API keys and tokens to an OpenClaw environment often leads to leaked secret values in logs, mismatched environment variable names, and broken disaster recovery when loaders fall out of sync. This Skill standardizes secret onboarding so credentials land in macOS Keychain and every dependent file stays aligned. ## Core Features & Use Cases - Keychain Storage Without Exposure: Reads the secret silently from the terminal and pipes it via stdin to a helper script, keeping values off command-line arguments and shell history. - Naming Enforcement: Derives and validates the Keychain service name (openclaw.<name>) and environment variable (OPENCLAW_<NAME>) so lookups never mismatch. - Multi-File Propagation: Updates openclaw-secrets.sh, openclaw-env.sh, and provisioning secrets.sh, then verifies the mapping resolves and no literal secret leaked into git-tracked files. - Use Case: When adding a new bot token for an OpenClaw gateway, run this Skill to store it in Keychain, wire all shell loaders, and confirm disaster recovery scripts can reprovision it on a new machine. ## Quick Start Ask the agent to add a new OpenClaw secret named my-api-key and wire it into the gateway, shell, and provisioning loaders.
