backendenc
Backend Agent Data Encryption. High-security MK->KEK->DEK hierarchy for backend environments.
ソース情報
- リポジトリ
- Jinhong270/AI-Agent
- ソースの最終更新活動
- 2026年6月29日 12:28
- 検出された SKILL.md の言語
- 英語
- スター
- 3
- フォーク
- 0
インストール方法
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
ソースファイルを確認
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
ファイルエクスプローラー
5 ファイルSKILL.md を表示中
SKILL.md
ソースの指示 · 読み取り専用プレビュー- name
- backendenc
- description
- Backend Agent Data Encryption. High-security MK->KEK->DEK hierarchy for backend environments.
# backendenc: Backend Security Toolkit
This skill provides mandatory encryption for OpenClaw agents running in **Node.js/Backend** environments. It operates in **Local Manual Mode**, using the Node.js built-in `crypto` module.
## Context
Unlike the frontend version which uses Web Crypto, this version is designed for server-side execution, CLI tools, or background agents. It stores metadata in a persistent local file (or compatible storage provider).
## Key Hierarchy
1. **Master Key (MK)**: Derived from your passphrase using `crypto.pbkdf2`.
* **Persistence**: A unique "Salt" is stored in your configuration. As long as you remember your passphrase, the same Master Key will be generated across reboots.
2. **Key Encryption Key (KEK)**: Generated randomly and encrypted by your MK.
3. **Data Encryption Keys (DEKs)**: Scoped keys (e.g., `memory`, `assets`) encrypted by the KEK.
## Security Disclosure
- **Zero Network**: This skill does NOT perform any external network requests. All operations happen via the Node.js `crypto` module.
- **No Cleartext Keys**: Keys are never stored in cleartext. They are always "wrapped" (encrypted) by a higher-level key using AES-256-GCM.
- **Passphrase Obligation**: You must provide your passphrase to "unlock" the vault after هر server reboot.
## Multi-User & Channel Isolation
Designed for high-concurrency backend environments:
- **Key Partitioning**: All storage keys follow the `${userId}:${channelId}:key` format.
- **Security**: Ensures that even if the underlying storage file is compromised, keys for different users remain cryptographically separated.
## Usage (Backend)
```javascript
import { EncryptionService } from './encryption-service.js';
// Access context IDs
const { userId, channelId } = agent.context;
// Unlock for context
await EncryptionService.unlock(userId, channelId, 'passphrase');
// Scoped encryption
const encrypted = await EncryptionService.encrypt(userId, channelId, 'history', 'data');
```
GitHubで見る