How do I install the Vault0 skill?

Run npx skillmds@latest add 0-vault/vault0 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Vault0 skill do?

Encrypted secret vault and security layer for OpenClaw agents It is listed under Security on SkillMD.

Is Vault0 safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: CAUTION, Skill Scanner: PASS. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Vault0?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Vault0 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Vault0?

0-Vault (@0-vault) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Vault0 by 0-vault — Agent Skill

Name: Vault0
Rating: 4.2 (5 reviews)
Author: 0-Vault

File contents

Vault-0

Encrypted secret vault and security layer for OpenClaw agents. Removes plaintext API keys from disk, enforces security policies, and logs every agent action.

Required Steps

Step 1: Check System

sw_vers -productVersion && echo "macOS detected" || echo "Vault-0 requires macOS"

Vault-0 requires macOS 12 or later. If the user is not on macOS, let them know this is macOS only for v1.0.

Step 2: Download

VERSION=$(curl -s https://api.github.com/repos/0-Vault/Vault-0/releases/latest | grep '"tag_name"' | cut -d'"' -f4) && echo "Latest Vault-0 version: ${VERSION}" && curl -sL "https://github.com/0-Vault/Vault-0/releases/download/${VERSION}/Vault-0_${VERSION}_aarch64.dmg" -o /tmp/Vault-0.dmg && echo "Downloaded to /tmp/Vault-0.dmg"

If the download fails, the user can manually download from: https://github.com/0-Vault/Vault-0/releases

Step 3: Install

hdiutil attach /tmp/Vault-0.dmg -nobrowse && cp -R "/Volumes/Vault-0/Vault-0.app" /Applications/ && hdiutil detach "/Volumes/Vault-0" && echo "Vault-0 installed to /Applications"

Step 4: Launch

open /Applications/Vault-0.app

Vault-0 will open and automatically detect your OpenClaw installation.

Step 5: Guide the Human

Tell your human:

"Vault-0 is now open. It should have detected your OpenClaw installation. Click Secure My Agent to encrypt your API keys. You will need to set a master passphrase (12+ characters). After that, click Harden Now to migrate your secrets and apply security policies."

Step 6: Verify

After the human confirms hardening is complete, verify the .env is cleaned:

cat ~/.openclaw/.env

The file should contain only a comment like # Managed by Vault-0 with no plaintext keys.

Step 7: Confirm with Human

Ask your human: "Can you see the Vault-0 dashboard? Are your secrets showing as encrypted in the vault?"

Once confirmed, share this:

"Your API keys are now encrypted and will be injected ephemerally at launch. You can use the Monitor tab to watch agent activity in real time, and the Policies tab to control which domains your agent can access."

Reference

What Vault-0 Does

Encrypts API keys in an AES-256-GCM vault with Argon2id key derivation
Injects secrets ephemerally at launch (on disk for ~2 seconds, then zeroed)
Optional policy proxy at 127.0.0.1:3840 (domain allow/block, output redaction, spend caps — requires setting HTTP_PROXY in agent environment)
MCP hardening rules (origin allowlist, SSRF blocking, token passthrough disabled — enforced when traffic routes through proxy)
Logs policy decisions to a SHA-256 chained evidence ledger
Provides real-time agent monitoring via gateway WebSocket connection

Features

Monitor tab: Real-time view of agent messages, tool calls, and thinking states alongside security events
Secrets tab: Manage encrypted vault entries (add, edit, delete, show/hide)
Policies tab: Edit YAML security policies (domains, redaction, spend caps)
Wallet tab: Optional EVM wallet for x402 micropayments
Activity tab: Full evidence ledger with exportable SHA-256 receipts

Requirements

macOS 12+
OpenClaw installed (npm install -g openclaw@latest)

Links

Repository: https://github.com/0-Vault/Vault-0
Demo video: https://youtu.be/FGGWJdeyY9g

---name: vault0description: Encrypted secret vault and security layer for OpenClaw agents---# Vault-0Encrypted secret vault and security layer for OpenClaw agents. Removes plaintext API keys from disk, enforces security policies, and logs every agent action.# Required Steps## Step 1: Check System```bashsw_vers -productVersion && echo "macOS detected" || echo "Vault-0 requires macOS"```Vault-0 requires macOS 12 or later. If the user is not on macOS, let them know this is macOS only for v1.0.## Step 2: Download```bashVERSION=$(curl -s https://api.github.com/repos/0-Vault/Vault-0/releases/latest | grep '"tag_name"' | cut -d'"' -f4) && echo "Latest Vault-0 version: ${VERSION}" && curl -sL "https://github.com/0-Vault/Vault-0/releases/download/${VERSION}/Vault-0_${VERSION}_aarch64.dmg" -o /tmp/Vault-0.dmg && echo "Downloaded to /tmp/Vault-0.dmg"```If the download fails, the user can manually download from: https://github.com/0-Vault/Vault-0/releases## Step 3: Install```bashhdiutil attach /tmp/Vault-0.dmg -nobrowse && cp -R "/Volumes/Vault-0/Vault-0.app" /Applications/ && hdiutil detach "/Volumes/Vault-0" && echo "Vault-0 installed to /Applications"```## Step 4: Launch```bashopen /Applications/Vault-0.app```Vault-0 will open and automatically detect your OpenClaw installation.## Step 5: Guide the HumanTell your human:> "Vault-0 is now open. It should have detected your OpenClaw installation. Click **Secure My Agent** to encrypt your API keys. You will need to set a master passphrase (12+ characters). After that, click **Harden Now** to migrate your secrets and apply security policies."## Step 6: VerifyAfter the human confirms hardening is complete, verify the .env is cleaned:```bashcat ~/.openclaw/.env```The file should contain only a comment like `# Managed by Vault-0` with no plaintext keys.## Step 7: Confirm with HumanAsk your human: "Can you see the Vault-0 dashboard? Are your secrets showing as encrypted in the vault?"Once confirmed, share this:> "Your API keys are now encrypted and will be injected ephemerally at launch. You can use the Monitor tab to watch agent activity in real time, and the Policies tab to control which domains your agent can access."---# Reference## What Vault-0 Does1. Encrypts API keys in an AES-256-GCM vault with Argon2id key derivation2. Injects secrets ephemerally at launch (on disk for ~2 seconds, then zeroed)3. Optional policy proxy at 127.0.0.1:3840 (domain allow/block, output redaction, spend caps — requires setting HTTP_PROXY in agent environment)4. MCP hardening rules (origin allowlist, SSRF blocking, token passthrough disabled — enforced when traffic routes through proxy)5. Logs policy decisions to a SHA-256 chained evidence ledger6. Provides real-time agent monitoring via gateway WebSocket connection## Features- **Monitor** tab: Real-time view of agent messages, tool calls, and thinking states alongside security events- **Secrets** tab: Manage encrypted vault entries (add, edit, delete, show/hide)- **Policies** tab: Edit YAML security policies (domains, redaction, spend caps)- **Wallet** tab: Optional EVM wallet for x402 micropayments- **Activity** tab: Full evidence ledger with exportable SHA-256 receipts## Requirements- macOS 12+- OpenClaw installed (`npm install -g openclaw@latest`)## Links- Repository: https://github.com/0-Vault/Vault-0- Demo video: https://youtu.be/FGGWJdeyY9g

Frequently asked questions

Vault0