什么是 Vault？

Vault 是专为需要以稳健方式处理本地敏感数据的开发者设计的专业安全工具。通过与 Openclaw Skills 集成，该工具允许用户使用受主密钥保护的行业标准 AES-256-GCM 加密来加密密码、API 令牌和其他凭据。

该技能专注于提供默认安全的环境，其中机密信息绝不会以明文形式存储。它利用 scrypt 进行密钥派生，并使用认证标签确保数据完整性，使其成为在 Openclaw Skills 生态系统中管理机密的可靠选择。

下载入口:https://github.com/openclaw/skills/tree/main/skills/zuiho-kai/vault

安装与下载

1. ClawHub CLI

从源直接安装技能的最快方式。

2. 手动安装

将技能文件夹复制到以下位置之一

优先级：工作区 > 本地 > 内置

3. 提示词安装

将此提示词复制到 OpenClaw 即可自动安装。

Vault 应用场景

• 为 OpenAI 或 Anthropic 等 AI 模型存储敏感的 API 密钥。
• 管理特定环境的凭据，而无需承受在版本控制中泄露的风险。
• 为个人或团队共享的令牌维护一个本地加密仓库。
• 在开发工作流中为其他 Openclaw Skills 自动检索凭据。

1. 用户初始化技能并设置强制性的 VAULT_MASTER_KEY 环境变量。
2. 保存密码时，技能会生成唯一的 32 字节盐值和 12 字节初始化向量 (IV)。
3. 使用 scrypt 派生加密密钥，并使用 AES-256-GCM 对值进行加密。
4. 加密后的负载、盐值、IV 和认证标签将保存到本地 JSON 存储文件中。
5. 要检索机密，技能使用主密钥对条目进行解密并在显示到终端前验证其完整性。

Vault 配置指南

要将此技能作为 Openclaw Skills 集合的一部分安装，请运行：

clawhub install vault

您必须配置主密钥以启用加密：

export VAULT_MASTER_KEY="your-secure-master-key-here"

您也可以在本地设置中定义配置：

{
  "plugins": {
    "vault": {
      "masterKey": "your-secure-master-key-here",
      "storageFile": ".vault/passwords.json"
    }
  }
}

Vault 数据架构与分类体系

该技能以结构化 JSON 格式管理其数据。以下是用于存储凭据的元数据分类：

name: vault
description: Secure local password storage tool with AES-256-GCM encryption. Store, retrieve, and manage passwords with CLI commands.
version: 1.1.2
author: zuiho-kai
homepage: https://github.com/zuiho-kai/openclaw-vault
tags: [password, vault, security, credentials, password-manager, cli, encryption]
metadata:
  openclaw:
    requires:
      bins: [node, npm]
      env: [VAULT_MASTER_KEY]

vault

Use when you need secure local storage for passwords, API keys, or credentials.

?? AES-256-GCM encryption - This plugin stores passwords encrypted using industry-standard AES-256-GCM encryption with a master key.

Features

• ?? AES-256-GCM encryption for all stored passwords
• ?? Simple command-line interface
• ??? Key management and listing
• ?? JSON-based local storage (encrypted)
• ?? Automatic timestamp tracking
• ?? Master key protection

Installation

clawhub install vault

Usage

Set a password

vault gemini sk-abc123xyz

Show a password

vault gemini show

Remove a password

vault gemini remove

List all keys

vault list

Configuration

Master Key (Required)

Set your master encryption key via environment variable:

export VAULT_MASTER_KEY="your-secure-master-key-here"

Or in your OpenClaw config:

{
  "plugins": {
    "vault": {
      "masterKey": "your-secure-master-key-here",
      "storageFile": ".vault/passwords.json"
    }
  }
}

Options:

• masterKey - Master encryption key (can also use VAULT_MASTER_KEY env var)
• storageFile (default: .vault/passwords.json) - Storage file path relative to home directory

?? Important: Keep your master key secure! Without it, you cannot decrypt stored passwords.

Security

?? Encryption Details:

• Algorithm: AES-256-GCM (Galois/Counter Mode)
• Key Derivation: scrypt with random salt per password
• IV: Random 12-byte initialization vector per password (GCM recommended size)
• Salt: Random 32-byte salt per password, stored with encrypted data
• Authentication: GCM authentication tag for integrity verification

Security Best Practices:

• Use a strong, unique master key (minimum 32 characters recommended)
• Store master key securely (environment variable or secure config)
• Set strict file permissions: chmod 600 ~/.vault/passwords.json
• Add .vault/ to your .gitignore
• Never commit your master key to version control
• Use system-level disk encryption for additional protection
• Backup your master key securely - lost keys mean lost passwords

Suitable for:

• Development/testing credentials
• API keys and tokens
• Personal passwords
• Team shared credentials (with secure key distribution)

Examples

# Save API keys
vault openai sk-proj-abc123
vault anthropic sk-ant-xyz789

# View a key
vault openai show
# Output: Password for 'openai': sk-proj-abc123

# List all keys
vault list
# Output:
# Stored passwords:
# ? openai (created: 2026-02-17T..., updated: 2026-02-17T...)
# ? anthropic (created: 2026-02-17T..., updated: 2026-02-17T...)

# Remove a key
vault openai remove

Links

• GitHub: https://github.com/zuiho-kai/openclaw-vault
• Issues: https://github.com/zuiho-kai/openclaw-vault/issues