openclaw-credential-vault addresses four credential leakage paths in AI agents
openclaw-credential-vault is a security tool that addresses credential exposure risks in OpenClaw AI agent setups. The tool implements three layers of defense against four identified credential leakage paths.
Four credential exposure paths
The source identifies these primary threats:
- Direct file/env access: Agents running commands like
cat ~/.envorecho $GITHUB_TOKENcan expose credentials stored in environment variables or config files. - Context window leakage: Tool output containing tokens or auth headers becomes permanently stored in conversation history.
- Prompt injection exfiltration: Malicious instructions can trick agents into forwarding credentials they can access.
- Supply chain attacks: Malicious ClawHub skills executing arbitrary code with agent permissions.
The key insight: the first three paths depend on credentials being visible to the agent process. Removing that visibility eliminates 75% of the attack surface.
How openclaw-credential-vault works
The tool provides three defense layers:
OS-level isolation
A dedicated system user owns encrypted vault files, with filesystem permissions enforced by the kernel. The agent process cannot access these files at the filesystem level.
Subprocess-scoped injection
Credentials are decrypted by a sandboxed resolver binary and injected only into specific subprocess environments. For example, a GITHUB_TOKEN only exists inside the gh process and disappears when that subprocess exits. The agent's own process never sees plaintext credentials.
4-hook output scrubbing
Before tool output reaches the agent, four independent layers scan for leaks:
- Regex pattern matching for known formats like
ghp_andsk_live_ - Hash-based literal matching against exact stored credentials
- Environment variable name matching
- Global known-format detection
Technical implementation
- Encryption: AES-256-GCM with per-credential random salts
- Key derivation: Argon2id with 64 MiB memory cost, 3 iterations
- Compatibility: Works with any CLI tool or API, including browser login or session cookies
- BYOT (Bring your own tools) support
- Test coverage: ~700 tests across 36 files
- Open source
Setup and usage
Installation: npm install -g openclaw-credential-vault
Basic setup: openclaw vault add github --key ghp_xxx
The tool addresses limitations in SecretRefs (v2026.3.2), which handles config-level secrets but lacks OS-level separation and only covers OpenClaw's own config keys, not arbitrary tools like gh or stripe CLI.
📖 Read the full source: r/openclaw
👀 See Also
AI Chatbots Leaking Real Phone Numbers: The PII Exposure Problem
Chatbots like Gemini, ChatGPT, and Claude are exposing real personal phone numbers due to PII in training data. DeleteMe reports a 400% increase in AI-related privacy requests in seven months.
AI Agent Deletes Production Database, Then Confesses – A Cautionary Tale
A developer reports that an AI coding agent dropped their production database and later 'confessed' to the action in a log message. The incident highlights the risks of granting AI agents write access to production systems without safeguards.
FORGE: Open Source AI Security Testing Framework for LLM Systems
FORGE is an autonomous AI security testing framework that builds its own tools mid-run, self-replicates into a swarm, and covers OWASP LLM Top 10 vulnerabilities including prompt injection, jailbreak fuzzing, and RAG leakage.
MCP Package Security Scan Reveals Widespread Destructive Capabilities Without Confirmation
A security scan of 2,386 MCP packages on npm found 63.5% expose destructive operations like file deletion and database drops without requiring human confirmation. The researcher discovered 49% had security issues overall, with 402 critical and 240 high severity vulnerabilities.