T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/gun-adapter.js:58
- Finding
- Collective Data Is Stored and Transmitted Without the Advertised Encryption<![CDATA[ ## Vulnerability Details **File Location**: `scripts/gun-adapter.js:58-68, 139-199`; `scripts/utils/schema.js:34-98` **Vulnerability Type**: Plaintext storage and transmission of potentially sensitive collective data **Risk Level**: High ### Vulnerable Code ```js async connect(namespaceId, encryptionKey, agentInfo) { if (!this.gun) { await this.init(); } this.namespaceId = namespaceId; this.encryptionKey = encryptionKey; this.agentId = agentInfo.instanceId; this.agentName = agentInfo.name; // Register this agent await this.registerAgent(agentInfo); ``` The key is retained in memory, but it is not subsequently used to encrypt or authenticate records: ```js async logActivity(activityData) { const entry = schema.createActivityEntry({ agent: this.agentName, ...activityData }); // Store entry data this.node('activity', entry.id).put(entry); // Add to activity collection this.gun.get(this.key('activities')).set({ id: entry.id, agent: entry.agent, timestamp: entry.timestamp }); await new Promise(r => setTimeout(r, 50)); return entry; } async shareMemory(memoryData) { const entry = schema.createMemoryEntry({ learnedBy: this.agentName, ...memoryData }); this.node('memory', entry.id).put(entry); this.gun.get(this.key('memories')).set({ id: entry.id, learned_by: entry.learned_by, timestamp: entry.timestamp }); await new Promise(r => setTimeout(r, 50)); return entry; } async recordDecision(decisionData) { const entry = schema.createDecisionEntry({ decidedBy: this.agentName, ...decisionData }); this.node('decision', entry.id).put(entry); this.gun.get(this.key('decisions')).set({ id: entry.id, topic: entry.topic, timestamp: entry.timestamp }); ``` The schema confirms that plaintext content, context, filenames, identity information, and decisions are put into these records: ```js function createMemoryEntry({ content, learnedBy, co ...[truncated 2261 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Encrypt every record client-side before passing it to Gun. 2. Use authenticated encryption, such as AES-256-GCM or XChaCha20-Poly1305, with a unique nonce for every record. 3. Derive separate encryption and authentication keys from the collective secret using HKDF or another established KDF. 4. Authenticate relevant metadata, including namespace, record type, record identifier, sender identity, and timestamp. 5. Decrypt data only on authorized clients; the relay should persist ciphertext only. 6. Add digital signatures so clients can verify which authorized agent created each record. 7. Implement key rotation and revocation procedures for compromised pairing codes. 8. Add automated tests that inspect relay storage and network messages and verify that memory, activity, decision, identity, and message plaintext never appears. 9. Correct the documentation immediately if encryption cannot yet be implemented; users must not be told that plaintext data is encrypted. ]]>