Backendenc

Backend Agent Data Encryption. High-security MK->KEK->DEK hierarchy for backend environments.

Security Scan

The skill implements an on-disk MK→KEK→DEK key hierarchy using Node.js crypto and local storage; its code and declared behavior are coherent with the described purpose, but review local storage placement and operational safeguards before deploying.

Purpose & Capability

Name/description claim a backend encryption toolkit and the package contains Node.js code using the native crypto and fs modules to implement an MK→KEK→DEK hierarchy and per-user/channel isolation. Requested resources (none) and included files align with the stated purpose.

Instruction Scope

SKILL.md and the code limit operations to local cryptography and local storage (no network calls). However, the service persistently writes a vault file (.anydef-vault.json) and an .anydef-vault directory under process.cwd(), and relies on the agent's context (userId, channelId) and a user-supplied passphrase. This is within the stated scope but operationally significant (see guidance).

Install Mechanism

There is no install spec (instruction-only skill with a bundled JS file). Nothing is downloaded from external URLs and no binaries are added, which is low-risk and consistent with the skill being a Node.js library/module.

Credentials

The skill requests no environment variables or external credentials. It requires filesystem access (fs) and Node crypto, which are proportionate to local encryption and persistent storage responsibilities declared in the README and metadata.

Persistence & Privilege

always is false and the skill does not request elevated platform privileges. It does persist encrypted blobs and separate asset files to the current working directory; this persistent presence is reasonable for a vault service but may require careful placement and file-permission controls in production.

Assessment

This skill appears to implement what it says: local, node-native encryption with per-user/channel isolation. Before installing or enabling it in production, review and decide on these operational points: (1) Default storage is process.cwd()/.anydef-vault.json and .anydef-vault — ensure the agent's working directory is a secure location (not a repo root or world-readable directory) and set file permissions appropriately. (2) The vault is unlocked with a passphrase supplied at runtime; losing the passphrase means losing access. Plan passphrase management and recovery. (3) Consider replacing or configuring the storage backend if you prefer an OS secret manager or DB adapter rather than filesystem JSON. (4) Audit concurrency and backup behavior for your deployment (multiple processes writing same file). (5) Source/homepage is missing — if provenance matters for your environment, request the upstream source or signing information from the publisher before trusting in a sensitive environment.

backendenc: Backend Security Toolkit

This skill provides mandatory encryption for OpenClaw agents running in Node.js/Backend environments. It operates in Local Manual Mode, using the Node.js built-in crypto module.

Context

Unlike the frontend version which uses Web Crypto, this version is designed for server-side execution, CLI tools, or background agents. It stores metadata in a persistent local file (or compatible storage provider).

Key Hierarchy

1. Master Key (MK): Derived from your passphrase using crypto.pbkdf2.
   • Persistence: A unique "Salt" is stored in your configuration. As long as you remember your passphrase, the same Master Key will be generated across reboots.
2. Key Encryption Key (KEK): Generated randomly and encrypted by your MK.
3. Data Encryption Keys (DEKs): Scoped keys (e.g., memory, assets) encrypted by the KEK.

Security Disclosure

• Zero Network: This skill does NOT perform any external network requests. All operations happen via the Node.js crypto module.
• No Cleartext Keys: Keys are never stored in cleartext. They are always "wrapped" (encrypted) by a higher-level key using AES-256-GCM.
• Passphrase Obligation: You must provide your passphrase to "unlock" the vault after هر server reboot.

Multi-User & Channel Isolation

Designed for high-concurrency backend environments:

• Key Partitioning: All storage keys follow the ${userId}:${channelId}:key format.
• Security: Ensures that even if the underlying storage file is compromised, keys for different users remain cryptographically separated.

Usage (Backend)

import { EncryptionService } from './encryption-service.js';

// Access context IDs
const { userId, channelId } = agent.context;

// Unlock for context
await EncryptionService.unlock(userId, channelId, 'passphrase');

// Scoped encryption
const encrypted = await EncryptionService.encrypt(userId, channelId, 'history', 'data');