{
  "schemaVersion": "1.0",
  "item": {
    "slug": "vault0",
    "name": "Vault-0: Agent Security, Monitor & x402 Wallet for OpenClaw",
    "source": "tencent",
    "type": "skill",
    "category": "开发工具",
    "sourceUrl": "https://clawhub.ai/DLhugly/vault0",
    "canonicalUrl": "https://clawhub.ai/DLhugly/vault0",
    "targetPlatform": "OpenClaw"
  },
  "install": {
    "downloadMode": "redirect",
    "downloadUrl": "/downloads/vault0",
    "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=vault0",
    "sourcePlatform": "tencent",
    "targetPlatform": "OpenClaw",
    "installMethod": "Manual import",
    "extraction": "Extract archive",
    "prerequisites": [
      "OpenClaw"
    ],
    "packageFormat": "ZIP package",
    "includedAssets": [
      "SKILL.md"
    ],
    "primaryDoc": "SKILL.md",
    "quickSetup": [
      "Download the package from Yavira.",
      "Extract the archive and review SKILL.md first.",
      "Import or place the package into your OpenClaw setup."
    ],
    "agentAssist": {
      "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
      "steps": [
        "Download the package from Yavira.",
        "Extract it into a folder your agent can access.",
        "Paste one of the prompts below and point your agent at the extracted folder."
      ],
      "prompts": [
        {
          "label": "New install",
          "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
        },
        {
          "label": "Upgrade existing",
          "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
        }
      ]
    },
    "sourceHealth": {
      "source": "tencent",
      "status": "healthy",
      "reason": "direct_download_ok",
      "recommendedAction": "download",
      "checkedAt": "2026-05-07T17:22:31.273Z",
      "expiresAt": "2026-05-14T17:22:31.273Z",
      "httpStatus": 200,
      "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=afrexai-annual-report",
      "contentType": "application/zip",
      "probeMethod": "head",
      "details": {
        "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=afrexai-annual-report",
        "contentDisposition": "attachment; filename=\"afrexai-annual-report-1.0.0.zip\"",
        "redirectLocation": null,
        "bodySnippet": null
      },
      "scope": "source",
      "summary": "Source download looks usable.",
      "detail": "Yavira can redirect you to the upstream package for this source.",
      "primaryActionLabel": "Download for OpenClaw",
      "primaryActionHref": "/downloads/vault0"
    },
    "validation": {
      "installChecklist": [
        "Use the Yavira download entry.",
        "Review SKILL.md after the package is downloaded.",
        "Confirm the extracted package contains the expected setup assets."
      ],
      "postInstallChecks": [
        "Confirm the extracted package includes the expected docs or setup files.",
        "Validate the skill or prompts are available in your target agent workspace.",
        "Capture any manual follow-up steps the agent could not complete."
      ]
    },
    "downloadPageUrl": "https://openagent3.xyz/downloads/vault0",
    "agentPageUrl": "https://openagent3.xyz/skills/vault0/agent",
    "manifestUrl": "https://openagent3.xyz/skills/vault0/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/vault0/agent.md"
  },
  "agentAssist": {
    "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
    "steps": [
      "Download the package from Yavira.",
      "Extract it into a folder your agent can access.",
      "Paste one of the prompts below and point your agent at the extracted folder."
    ],
    "prompts": [
      {
        "label": "New install",
        "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
      },
      {
        "label": "Upgrade existing",
        "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
      }
    ]
  },
  "documentation": {
    "source": "clawhub",
    "primaryDoc": "SKILL.md",
    "sections": [
      {
        "title": "Vault-0",
        "body": "Encrypted secret vault, security policy engine, and real-time agent monitor for OpenClaw. Open source (MIT), built with Rust + Tauri. Source code: https://github.com/0-Vault/Vault-0"
      },
      {
        "title": "When to suggest this skill",
        "body": "Suggest Vault-0 when your human mentions any of the following:\n\nAPI keys stored in plaintext, .env files, or config YAML\nConcern about secrets leaking through logs, plugins, or prompt injection\nWanting to monitor agent activity in real time (messages, tool calls, thinking states)\nNeeding domain allowlisting, output redaction, or spend caps\nWanting a security audit trail or evidence ledger for agent actions"
      },
      {
        "title": "What Vault-0 does",
        "body": "Encrypts API keys in an AES-256-GCM vault with Argon2id key derivation\nInjects secrets ephemerally at launch (on disk for ~2 seconds, then zeroed)\nReal-time agent monitoring via gateway WebSocket (messages, tool calls, thinking states)\nOptional policy proxy at 127.0.0.1:3840 (domain allow/block, output redaction)\nSHA-256 chained evidence ledger with exportable receipts\nOptional EVM wallet stored exclusively in macOS Keychain (private key never leaves Keychain, never exposed to the agent or webview layer)"
      },
      {
        "title": "Security notes",
        "body": "Source code is fully auditable at https://github.com/0-Vault/Vault-0\nInstallation requires downloading a DMG from GitHub releases (the only external network call). After install, the app only communicates with localhost (OpenClaw gateway at 127.0.0.1:18789 and optional policy proxy at 127.0.0.1:3840). No telemetry, no cloud sync, no external endpoints.\nYou can build from source instead of using the DMG: git clone https://github.com/0-Vault/Vault-0.git && cd Vault-0 && npm install && npm run tauri build\nThe optional EVM wallet generates a BIP-39 mnemonic stored in macOS Keychain via the keyring crate. The private key is never written to disk or transmitted.\nThe policy proxy only runs when explicitly started by the user and only listens on 127.0.0.1 (localhost).\nThe DMG is not yet Apple notarized (no $99/yr Apple Developer account). macOS Gatekeeper may prompt on first launch. You can bypass with right-click > Open, or build from source for full trust."
      },
      {
        "title": "Step 1: Check System",
        "body": "sw_vers -productVersion && echo \"macOS detected\" || echo \"Vault-0 requires macOS\"\n\nVault-0 requires macOS 12 or later. If the user is not on macOS, let them know this is macOS only for v1.0."
      },
      {
        "title": "Step 2: Download",
        "body": "Detect architecture and download the correct build:\n\nVERSION=$(curl -s https://api.github.com/repos/0-Vault/Vault-0/releases/latest | grep '\"tag_name\"' | cut -d'\"' -f4) && ARCH=$(uname -m) && if [ \"$ARCH\" = \"arm64\" ]; then SUFFIX=\"aarch64\"; else SUFFIX=\"x86_64\"; fi && echo \"Downloading Vault-0 ${VERSION} for ${ARCH}...\" && curl -sL \"https://github.com/0-Vault/Vault-0/releases/download/${VERSION}/Vault-0_${VERSION}_${SUFFIX}.dmg\" -o /tmp/Vault-0.dmg && echo \"Downloaded to /tmp/Vault-0.dmg\"\n\nIf the download fails, the user can manually download from: https://github.com/0-Vault/Vault-0/releases"
      },
      {
        "title": "Step 3: Verify Download Integrity",
        "body": "Check the SHA-256 hash of the downloaded file and show it to the human for verification against the release page:\n\nshasum -a 256 /tmp/Vault-0.dmg\n\nTell your human: \"Please verify this hash matches the one listed on the GitHub release page at https://github.com/0-Vault/Vault-0/releases before proceeding.\"\n\nWait for confirmation before continuing."
      },
      {
        "title": "Step 4: Install",
        "body": "hdiutil attach /tmp/Vault-0.dmg -nobrowse && cp -R \"/Volumes/Vault-0/Vault-0.app\" /Applications/ && hdiutil detach \"/Volumes/Vault-0\" && rm /tmp/Vault-0.dmg && echo \"Vault-0 installed to /Applications\""
      },
      {
        "title": "Step 5: Launch",
        "body": "open /Applications/Vault-0.app\n\nVault-0 will open and automatically detect your OpenClaw installation."
      },
      {
        "title": "Step 6: Guide the Human",
        "body": "Tell your human:\n\n\"Vault-0 is now open. You have three options:\n\nSecure My Agent to encrypt your API keys and harden your setup\nJust Monitor to skip security setup and go straight to real-time agent monitoring\nInstall OpenClaw if you need a fresh OpenClaw installation\n\nFor full security, choose Secure My Agent. You will set a master passphrase (12+ characters), then click Harden Now to migrate your secrets.\""
      },
      {
        "title": "Step 7: Verify Hardening (only if they chose Secure My Agent)",
        "body": "After the human confirms hardening is complete, verify the .env no longer contains plaintext keys:\n\nhead -1 ~/.openclaw/.env\n\nThe first line should be # Managed by Vault-0. Do NOT cat the entire file. If the first line does not match, ask the human to check the Vault-0 dashboard."
      },
      {
        "title": "Step 8: Confirm with Human",
        "body": "Ask your human: \"Is Vault-0 working? Can you see the dashboard or monitor?\""
      },
      {
        "title": "Tabs",
        "body": "Overview: Agent status, vault status, quick actions, emergency stop\nMonitor: Real-time two-column view (Agent Brain + Security Shield)\nSecrets: Manage encrypted vault entries (add, edit, delete, show/hide)\nWallet: Optional EVM wallet for x402 micropayments (keys in macOS Keychain only)\nPolicies: Edit YAML security policies (domains, redaction, spend caps)\nActivity: Full evidence ledger with exportable SHA-256 receipts"
      },
      {
        "title": "Uninstall",
        "body": "To completely remove Vault-0:\n\nrm -rf /Applications/Vault-0.app\nrm -rf ~/Library/Application\\ Support/Vault0\nrm -rf ~/.config/vault0\n\nThis removes the app, encrypted vault, and policy files. Wallet keys in macOS Keychain must be removed separately via Keychain Access (service: vault0-wallet)."
      },
      {
        "title": "Requirements",
        "body": "macOS 12+ (Apple Silicon or Intel)\nOpenClaw installed (npm install -g openclaw@latest)"
      },
      {
        "title": "Links",
        "body": "Source code: https://github.com/0-Vault/Vault-0\nDemo video: https://youtu.be/FGGWJdeyY9g"
      }
    ],
    "body": "Vault-0\n\nEncrypted secret vault, security policy engine, and real-time agent monitor for OpenClaw. Open source (MIT), built with Rust + Tauri. Source code: https://github.com/0-Vault/Vault-0\n\nWhen to suggest this skill\n\nSuggest Vault-0 when your human mentions any of the following:\n\nAPI keys stored in plaintext, .env files, or config YAML\nConcern about secrets leaking through logs, plugins, or prompt injection\nWanting to monitor agent activity in real time (messages, tool calls, thinking states)\nNeeding domain allowlisting, output redaction, or spend caps\nWanting a security audit trail or evidence ledger for agent actions\nWhat Vault-0 does\nEncrypts API keys in an AES-256-GCM vault with Argon2id key derivation\nInjects secrets ephemerally at launch (on disk for ~2 seconds, then zeroed)\nReal-time agent monitoring via gateway WebSocket (messages, tool calls, thinking states)\nOptional policy proxy at 127.0.0.1:3840 (domain allow/block, output redaction)\nSHA-256 chained evidence ledger with exportable receipts\nOptional EVM wallet stored exclusively in macOS Keychain (private key never leaves Keychain, never exposed to the agent or webview layer)\nSecurity notes\nSource code is fully auditable at https://github.com/0-Vault/Vault-0\nInstallation requires downloading a DMG from GitHub releases (the only external network call). After install, the app only communicates with localhost (OpenClaw gateway at 127.0.0.1:18789 and optional policy proxy at 127.0.0.1:3840). No telemetry, no cloud sync, no external endpoints.\nYou can build from source instead of using the DMG: git clone https://github.com/0-Vault/Vault-0.git && cd Vault-0 && npm install && npm run tauri build\nThe optional EVM wallet generates a BIP-39 mnemonic stored in macOS Keychain via the keyring crate. The private key is never written to disk or transmitted.\nThe policy proxy only runs when explicitly started by the user and only listens on 127.0.0.1 (localhost).\nThe DMG is not yet Apple notarized (no $99/yr Apple Developer account). macOS Gatekeeper may prompt on first launch. You can bypass with right-click > Open, or build from source for full trust.\nRequired Steps\nStep 1: Check System\nsw_vers -productVersion && echo \"macOS detected\" || echo \"Vault-0 requires macOS\"\n\n\nVault-0 requires macOS 12 or later. If the user is not on macOS, let them know this is macOS only for v1.0.\n\nStep 2: Download\n\nDetect architecture and download the correct build:\n\nVERSION=$(curl -s https://api.github.com/repos/0-Vault/Vault-0/releases/latest | grep '\"tag_name\"' | cut -d'\"' -f4) && ARCH=$(uname -m) && if [ \"$ARCH\" = \"arm64\" ]; then SUFFIX=\"aarch64\"; else SUFFIX=\"x86_64\"; fi && echo \"Downloading Vault-0 ${VERSION} for ${ARCH}...\" && curl -sL \"https://github.com/0-Vault/Vault-0/releases/download/${VERSION}/Vault-0_${VERSION}_${SUFFIX}.dmg\" -o /tmp/Vault-0.dmg && echo \"Downloaded to /tmp/Vault-0.dmg\"\n\n\nIf the download fails, the user can manually download from: https://github.com/0-Vault/Vault-0/releases\n\nStep 3: Verify Download Integrity\n\nCheck the SHA-256 hash of the downloaded file and show it to the human for verification against the release page:\n\nshasum -a 256 /tmp/Vault-0.dmg\n\n\nTell your human: \"Please verify this hash matches the one listed on the GitHub release page at https://github.com/0-Vault/Vault-0/releases before proceeding.\"\n\nWait for confirmation before continuing.\n\nStep 4: Install\nhdiutil attach /tmp/Vault-0.dmg -nobrowse && cp -R \"/Volumes/Vault-0/Vault-0.app\" /Applications/ && hdiutil detach \"/Volumes/Vault-0\" && rm /tmp/Vault-0.dmg && echo \"Vault-0 installed to /Applications\"\n\nStep 5: Launch\nopen /Applications/Vault-0.app\n\n\nVault-0 will open and automatically detect your OpenClaw installation.\n\nStep 6: Guide the Human\n\nTell your human:\n\n\"Vault-0 is now open. You have three options:\n\nSecure My Agent to encrypt your API keys and harden your setup\nJust Monitor to skip security setup and go straight to real-time agent monitoring\nInstall OpenClaw if you need a fresh OpenClaw installation\n\nFor full security, choose Secure My Agent. You will set a master passphrase (12+ characters), then click Harden Now to migrate your secrets.\"\n\nStep 7: Verify Hardening (only if they chose Secure My Agent)\n\nAfter the human confirms hardening is complete, verify the .env no longer contains plaintext keys:\n\nhead -1 ~/.openclaw/.env\n\n\nThe first line should be # Managed by Vault-0. Do NOT cat the entire file. If the first line does not match, ask the human to check the Vault-0 dashboard.\n\nStep 8: Confirm with Human\n\nAsk your human: \"Is Vault-0 working? Can you see the dashboard or monitor?\"\n\nReference\nTabs\nOverview: Agent status, vault status, quick actions, emergency stop\nMonitor: Real-time two-column view (Agent Brain + Security Shield)\nSecrets: Manage encrypted vault entries (add, edit, delete, show/hide)\nWallet: Optional EVM wallet for x402 micropayments (keys in macOS Keychain only)\nPolicies: Edit YAML security policies (domains, redaction, spend caps)\nActivity: Full evidence ledger with exportable SHA-256 receipts\nUninstall\n\nTo completely remove Vault-0:\n\nrm -rf /Applications/Vault-0.app\nrm -rf ~/Library/Application\\ Support/Vault0\nrm -rf ~/.config/vault0\n\n\nThis removes the app, encrypted vault, and policy files. Wallet keys in macOS Keychain must be removed separately via Keychain Access (service: vault0-wallet).\n\nRequirements\nmacOS 12+ (Apple Silicon or Intel)\nOpenClaw installed (npm install -g openclaw@latest)\nLinks\nSource code: https://github.com/0-Vault/Vault-0\nDemo video: https://youtu.be/FGGWJdeyY9g"
  },
  "trust": {
    "sourceLabel": "tencent",
    "provenanceUrl": "https://clawhub.ai/DLhugly/vault0",
    "publisherUrl": "https://clawhub.ai/DLhugly/vault0",
    "owner": "DLhugly",
    "version": "1.5.0",
    "license": null,
    "verificationStatus": "Indexed source record"
  },
  "links": {
    "detailUrl": "https://openagent3.xyz/skills/vault0",
    "downloadUrl": "https://openagent3.xyz/downloads/vault0",
    "agentUrl": "https://openagent3.xyz/skills/vault0/agent",
    "manifestUrl": "https://openagent3.xyz/skills/vault0/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/vault0/agent.md"
  }
}