MySQLClaw Skill v1.0.6

The MySQLClaw skill provides a security-hardened interface for managing user data, personas, and configuration snapshots within a MySQL database, specifically designed for OpenClaw agents.

Capability Scope

This skill requires only MySQL database credentials (MYSQL_USER, MYSQL_PASSWORD, MYSQL_HOST, MYSQL_PORT). It does not require, request, or use wallet access, cryptocurrency keys, blockchain-related capabilities, financial transaction systems, or payment processing APIs. The skill's secret-redaction patterns include Stripe key detection purely as a defensive measure to prevent accidental storage of third-party secrets — it does not interact with Stripe or any payment system.

Dependencies

Required Environment Variables

Security Note: Passwords are never passed on the command line. All MySQL connections use a temporary --defaults-extra-file with chmod 600 that is deleted via trap EXIT -- even on failure.

Security Architecture

1. Credential Handling

• Passwords are never exposed on the command line or in process listings.
• A temporary credentials file (/tmp/.mysqlclaw_XXXXXX.cnf) is created with chmod 600, used for the connection, and deleted via trap EXIT -- guaranteed cleanup even on set -e failure.
• The setup wizard uses read -sp so the password is not echoed to the terminal.

2. SQL Execution Safety (sql_safe_exec.sh)

All SQL is routed through the sql_safe_exec.sh wrapper which enforces:

3. Script Execution (exec_script)

• custom_mysql exec_script --file path.sql routes all statements through sql_safe_exec.sh.
• Each statement is executed individually through the single-statement wrapper.
• Multi-statement lines are rejected; scripts must contain one statement per line.
• DML statements require interactive confirmation; DDL is blocked.
• Only bundled/reviewed SQL scripts included in this skill directory should be executed.

4. Snapshot Security

• Secret redaction: sanitize_snapshot.sh uses Perl-compatible regex to redact API keys, tokens, passwords, private keys, Stripe keys (sk_live_*), and GitHub tokens (ghp_*) before storage.
• Path whitelist: Only files matching patterns in allowed_snapshot_paths may be snapshotted.
• Untrusted by default: All snapshots are marked is_trusted = 0 until verified by a user.
• Retention policy: Snapshots older than 30 days are auto-purged via MySQL event. Manual purge: CALL sp_purge_snapshots(30);

5. Input Validation

• Database names, usernames, and identifiers are validated against ^[a-zA-Z_][a-zA-Z0-9_]{0,63}$.
• No eval is used anywhere in the skill.

Installation

cp -r custom_mysql /home/noodly/.openclaw/workspace/skills/
cd /home/noodly/.openclaw/workspace/skills/custom_mysql
./setup_wizard.sh

Creating a Least-Privilege MySQL User

CREATE USER 'mysqlclaw'@'localhost' IDENTIFIED BY 'strong_random_password';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, INDEX, EVENT, EXECUTE
    ON mysqlclaw.* TO 'mysqlclaw'@'localhost';
FLUSH PRIVILEGES;

Do not use a root or admin account.

Commands

Changelog

See changelog.md for full version history.