How do I install the Vault Client skill?

Run npx skillmds@latest add dvcrn/vault-client in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Vault Client safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: executes scripts, makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Vault Client?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Vault Client free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Vault Client?

dvcrn (@dvcrn) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Vault Client by dvcrn — Agent Skill

Name: Vault Client
Rating: 4.2 (5 reviews)
Author: dvcrn

Vault Client

Hashicorp Vault client for OpenClaw agents. Read and write secrets from a Vault server without raw curl commands or hardcoded tokens. Use when reading API keys, DB credentials, or any secret stored in Hashicorp Vault; checking token expiry; rotating secrets; or configuring Vault access for the first time. NOT for the zuiho-kai local Vault skill (that is a different, local-only tool).

dvcrn Updated Sep 8, 2026 32 repo stars

File contents

vault-client

Gives OpenClaw agents clean, cached access to Hashicorp Vault. No curl, no hardcoded tokens in transcripts.

Setup

Run once after installing:

node ~/.openclaw/workspace/skills/vault-client/scripts/vault.js setup

Prompts for address, token, and mount. Saves to ~/.openclaw/vault.json and appends a startup block to AGENTS.md.

Startup (every session)

node ~/.openclaw/workspace/skills/vault-client/scripts/vault.js check

Exit 0 = connected, token valid
Exit 1 = connected but token expires soon — warn user, run token-renew
Exit 2 = unreachable or invalid token — warn user, check config

Core commands

# Read all keys at a path
node vault.js get shopwalk/r2

# Read a single key (returns just the value — pipe-friendly)
node vault.js get shopwalk/database uri

# Write / update a secret (merges with existing keys)
node vault.js put shopwalk/r2 secret_access_key=newvalue

# List paths
node vault.js list shopwalk/

# Token management
node vault.js token-info
node vault.js token-renew

Config reference (`~/.openclaw/vault.json`)

{
  "address": "https://vault.example.com:8200",
  "mount": "secret",
  "auth": { "method": "token", "token": "hvs.xxx" },
  "cache_ttl_seconds": 300,
  "tls": { "verify": true }
}

Set tls.verify: false for internal Vault with self-signed certs.

Secrets are cached in ~/.openclaw/vault-cache.json for cache_ttl_seconds (default 5 min) to avoid repeated API calls.

Auth methods

Token auth is the default. For AppRole and Kubernetes auth, see references/auth-methods.md.

No dependencies

Uses Node.js stdlib only (https, fs, readline). No npm install required.

---name: vault-clientdescription: Hashicorp Vault client for OpenClaw agents. Read and write secrets from a Vault server without raw curl commands or hardcoded tokens. Use when reading API keys, DB credentials, or any secret stored in Hashicorp Vault; checking token expiry; rotating secrets; or configuring Vault access for the first time. NOT for the zuiho-kai local Vault skill (that is a different, local-only tool).---# vault-clientGives OpenClaw agents clean, cached access to Hashicorp Vault. No curl, no hardcoded tokens in transcripts.## SetupRun once after installing:```bashnode ~/.openclaw/workspace/skills/vault-client/scripts/vault.js setup```Prompts for address, token, and mount. Saves to `~/.openclaw/vault.json` and appends a startup block to `AGENTS.md`.## Startup (every session)```bashnode ~/.openclaw/workspace/skills/vault-client/scripts/vault.js check```- Exit 0 = connected, token valid- Exit 1 = connected but token expires soon — warn user, run `token-renew`- Exit 2 = unreachable or invalid token — warn user, check config## Core commands```bash# Read all keys at a pathnode vault.js get shopwalk/r2# Read a single key (returns just the value — pipe-friendly)node vault.js get shopwalk/database uri# Write / update a secret (merges with existing keys)node vault.js put shopwalk/r2 secret_access_key=newvalue# List pathsnode vault.js list shopwalk/# Token managementnode vault.js token-infonode vault.js token-renew```## Config reference (`~/.openclaw/vault.json`)```json{ "address": "https://vault.example.com:8200", "mount": "secret", "auth": { "method": "token", "token": "hvs.xxx" }, "cache_ttl_seconds": 300, "tls": { "verify": true }}```Set `tls.verify: false` for internal Vault with self-signed certs.Secrets are cached in `~/.openclaw/vault-cache.json` for `cache_ttl_seconds` (default 5 min) to avoid repeated API calls.## Auth methodsToken auth is the default. For AppRole and Kubernetes auth, see `references/auth-methods.md`.## No dependenciesUses Node.js stdlib only (`https`, `fs`, `readline`). No npm install required.

Frequently asked questions