T09 · Insecure Skill Coding Practices
Error
- Location
research_agent.py:22- Finding
Potentially sensitive agent activity is published to an immutable public blockchain without encryption by default
- Content
View full analysis
0 }, "status": "success" }) ``` ```python async def finish(self): """Complete session and flush logs""" await self.generate_summary() print("\n💾 Flushing logs to blockchain...") try: tx_id = await self.logger.flush() print(f"✓ Session archived to blockchain") print(f"🔗 Transaction: https://whatsonchain.com/tx/{tx_id}") return tx_id except Exception as e: print(f"❌ Error: {e}") return None ``` ### Technical Analysis The executable research example initializes `AuditLogger` without a PGP configuration and records the complete caller-supplied research query in the `details` field. The record is subsequently committed to the BSV blockchain. The configured `flush_threshold` may also cause records to be transmitted before the explicit `finish()` operation. Because blockchain data is public and immutable, information disclosed this way cannot be reliably deleted after discovery. Although the documentation recommends PGP for sensitive records, encryption is optional and is not enabled in the principal executable examples. The logger accepts an unrestricted `details` dictionary ...[truncated 1631 chars]- Remediation
View remediation