vault0
Provides a secure vault for API keys and real-time monitoring for OpenClaw agents, ensuring data protection and policy enforcement.
Install this skill
Security score
The vault0 skill was audited on Feb 16, 2026 and we found 17 security issues across 5 threat categories, including 4 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 55 | ```bash |
Curl to non-GitHub URL
| 56 | VERSION=$(curl -s https://api.github.com/repos/0-Vault/Vault-0/releases/latest | grep '"tag_name"' | cut -d'"' -f4) && ARCH=$(uname -m) && if [ "$ARCH" = "arm64" ]; then SUFFIX="aarch64"; else SUFFIX= |
Access to hidden dotfiles in home directory
| 3 | description: Security suite for OpenClaw agents. Encrypted secret storage (AES-256-GCM), real-time activity monitoring via gateway WebSocket, policy enforcement, and native x402 payment wallet with EI |
Access to hidden dotfiles in home directory
| 6 | metadata: {"emoji":"🔐","category":"security","os":"macos","minOS":"12","dependencies":["openclaw"],"configPaths":["~/.openclaw/.env","~/.openclaw/openclaw.json"],"networkAccess":"localhost-only-after |
Access to hidden dotfiles in home directory
| 103 | head -1 ~/.openclaw/.env |
Access to hidden dotfiles in home directory
| 132 | rm -rf ~/.config/vault0 |
Access to .env file
| 3 | description: Security suite for OpenClaw agents. Encrypted secret storage (AES-256-GCM), real-time activity monitoring via gateway WebSocket, policy enforcement, and native x402 payment wallet with EI |
Access to .env file
| 6 | metadata: {"emoji":"🔐","category":"security","os":"macos","minOS":"12","dependencies":["openclaw"],"configPaths":["~/.openclaw/.env","~/.openclaw/openclaw.json"],"networkAccess":"localhost-only-after |
Access to .env file
| 17 | 1. API keys stored in plaintext, .env files, or config YAML |
Access to .env file
| 100 | After the human confirms hardening is complete, verify the .env no longer contains plaintext keys: |
Access to .env file
| 103 | head -1 ~/.openclaw/.env |
Access to system keychain/keyring
| 30 | 6. Optional EVM wallet stored exclusively in macOS Keychain (private key never leaves Keychain, never exposed to the agent or webview layer) |
Access to system keychain/keyring
| 37 | 4. The optional EVM wallet generates a BIP-39 mnemonic stored in macOS Keychain via the keyring crate. The private key is never written to disk or transmitted. |
Access to system keychain/keyring
| 121 | 4. **Wallet**: Optional EVM wallet for x402 micropayments (keys in macOS Keychain only) |
Access to system keychain/keyring
| 135 | This removes the app, encrypted vault, and policy files. Wallet keys in macOS Keychain must be removed separately via Keychain Access (service: vault0-wallet). |
External URL reference
| 56 | VERSION=$(curl -s https://api.github.com/repos/0-Vault/Vault-0/releases/latest | grep '"tag_name"' | cut -d'"' -f4) && ARCH=$(uname -m) && if [ "$ARCH" = "arm64" ]; then SUFFIX="aarch64"; else SUFFIX= |
External URL reference
| 145 | 2. Demo video: https://youtu.be/FGGWJdeyY9g |