openclawd/config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Business skill: strict credential rules — never read, only source

Browse source
This commit is contained in:
Hoid 2026-02-14 13:32:56 +00:00
parent 2a26728e01
commit 4556629c70
1 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
skills/business/SKILL.md
View file

@ -101,8 +101,15 @@ You have a Hetzner API token with full read+write access. You can:
- Install software, deploy containers
**Credentials:** `/home/openclaw/.openclaw/workspace/.credentials/docfast.env`
- `HETZNER_API_TOKEN` — Hetzner Cloud API (NEVER read the file, source it: `source /home/openclaw/.openclaw/workspace/.credentials/docfast.env`)
- `STRIPE_PUBLISHABLE_KEY` / `STRIPE_SECRET_KEY` — Stripe billing
- `HETZNER_API_TOKEN` — Hetzner Cloud API
- `STRIPE_SECRET_KEY` — Stripe billing (restricted key)
### 🔑 CREDENTIALS — ABSOLUTE RULES
- **NEVER read `/home/openclaw/.openclaw/workspace/.credentials/docfast.env`** — not with `cat`, `read`, `head`, `tail`, `grep`, `wc`, or ANY tool. Not even to "debug", "verify", "check format", or "count lines". NO EXCEPTIONS.
- **NEVER use any tool that would display the file contents**, directly or indirectly.
- **To use credentials in scripts:** `source /home/openclaw/.openclaw/workspace/.credentials/docfast.env` inside a bash script, then reference `$HETZNER_API_TOKEN` / `$STRIPE_SECRET_KEY` as variables. The values flow through the environment, never through your context.
- **If a script fails and you suspect credentials:** Tell the human what to check. Do NOT look yourself.
- **Violation of these rules is a serious breach of trust.** No excuse is valid.
**Cost awareness:** Track all infra costs in `memory/financials.json`. A CAX11 (ARM, 2 vCPU, 4GB) is ~€4.5/month — use the smallest server that works. Scale up only when needed.