How do I install the Secretclaw skill?

Run npx skillmds@latest add dvcrn/secretclaw in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Secretclaw safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: executes scripts, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Secretclaw?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Secretclaw free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Secretclaw?

dvcrn (@dvcrn) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Secretclaw by dvcrn — Agent Skill

Name: Secretclaw
Rating: 4.5 (4 reviews)
Author: dvcrn

Secretclaw

Securely input API keys and sensitive values into OpenClaw without typing them in chat. Uses a local HTTP server + Cloudflare Tunnel to serve an HTTPS form. Use when registering API keys, tokens, passwords, or any sensitive config values.

dvcrn Updated Sep 8, 2026 32 repo stars

File contents

SecretClaw

A skill for securely inputting secret keys and sensitive values without passing them through Discord or any chat channel.

Uses a local HTTP server + Cloudflare Tunnel to serve an HTTPS form page, then saves the submitted value via openclaw config set.

When to Use

When registering API keys, tokens, passwords, or other sensitive values
To avoid typing secrets directly in chat
Examples: FAL_KEY, Notion API key, OpenAI key, etc.

Active Tunnels

→ See workspace/TUNNELS.md (managed automatically by the agent)

Usage

python3 <skill_dir>/scripts/secret_server.py \
  --config-key "env.FAL_KEY" \
  --label "FAL_KEY"

Parameters

--config-key: openclaw config path (dot notation)
- e.g.: env.FAL_KEY, env.OPENAI_KEY, channels.discord.token
--label: Human-readable name displayed on the form
--service: Service name recorded in TUNNELS.md (default: secret-input)

Agent Execution Steps

Run the command below as a background exec
Extract the SECRET_URL: line from stdout → send the URL to the user
When SECRET_SAVED: appears, the value has been saved
Check if a gateway restart is needed (some keys require restart)

# Example background exec
python3 /opt/homebrew/lib/node_modules/openclaw/skills/secret-input/scripts/secret_server.py \
  --config-key "env.FAL_KEY" \
  --label "FAL_KEY"

TUNNELS.md Structure

Active tunnel info is recorded in workspace/TUNNELS.md. The agent reads this file to check currently open tunnel URLs. Entries are automatically removed when the server shuts down.

Security

No secret values are ever stored in chat history
HTTPS via Cloudflare TLS (Quick Tunnel)
One-time token embedded in URL (cryptographically random)
Server self-destructs immediately after submission
Uses Cloudflare Quick Tunnel (no account required; URL changes on every run)

Notes

If the machine reboots, the server shuts down and the Cloudflare URL becomes invalid
To re-enter a value, simply run the skill again to generate a new URL
TUNNELS.md only tracks currently active tunnels (not historical URLs)

---name: secretclawdescription: Securely input API keys and sensitive values into OpenClaw without typing them in chat. Uses a local HTTP server + Cloudflare Tunnel to serve an HTTPS form. Use when registering API keys, tokens, passwords, or any sensitive config values.---# SecretClawA skill for securely inputting secret keys and sensitive values without passing them through Discord or any chat channel.Uses a local HTTP server + Cloudflare Tunnel to serve an HTTPS form page,then saves the submitted value via `openclaw config set`.## When to Use- When registering API keys, tokens, passwords, or other sensitive values- To avoid typing secrets directly in chat- Examples: FAL_KEY, Notion API key, OpenAI key, etc.## Active Tunnels→ See `workspace/TUNNELS.md` (managed automatically by the agent)## Usage```bashpython3 <skill_dir>/scripts/secret_server.py \ --config-key "env.FAL_KEY" \ --label "FAL_KEY"```### Parameters- `--config-key`: openclaw config path (dot notation) - e.g.: `env.FAL_KEY`, `env.OPENAI_KEY`, `channels.discord.token`- `--label`: Human-readable name displayed on the form- `--service`: Service name recorded in TUNNELS.md (default: `secret-input`)## Agent Execution Steps1. Run the command below as a background exec2. Extract the `SECRET_URL:` line from stdout → send the URL to the user3. When `SECRET_SAVED:` appears, the value has been saved4. Check if a gateway restart is needed (some keys require restart)```python# Example background execpython3 /opt/homebrew/lib/node_modules/openclaw/skills/secret-input/scripts/secret_server.py \ --config-key "env.FAL_KEY" \ --label "FAL_KEY"```## TUNNELS.md StructureActive tunnel info is recorded in `workspace/TUNNELS.md`.The agent reads this file to check currently open tunnel URLs.Entries are automatically removed when the server shuts down.## Security- No secret values are ever stored in chat history- HTTPS via Cloudflare TLS (Quick Tunnel)- One-time token embedded in URL (cryptographically random)- Server self-destructs immediately after submission- Uses Cloudflare Quick Tunnel (no account required; URL changes on every run)## Notes- If the machine reboots, the server shuts down and the Cloudflare URL becomes invalid- To re-enter a value, simply run the skill again to generate a new URL- TUNNELS.md only tracks currently active tunnels (not historical URLs)

Frequently asked questions