anydef-enc: Local Security Toolkit#

This skill provides mandatory encryption for OpenClaw agents. It operates in Local Manual Mode, meaning no external network requests are made, and encryption keys are derived from a user passphrase.

Key Hierarchy#

1. Master Key (MK): Derived from your passphrase using PBKDF2 (100,000 iterations).

   • Persistence: A unique "Salt" is stored in your environment. As long as you remember your passphrase, the same Master Key will be generated across reboots.

2. Key Encryption Key (KEK): Generated randomly and encrypted by your MK. Stored in window.storage.

3. Data Encryption Keys (DEKs): Scoped keys (e.g., memory, assets) encrypted by the KEK and stored in window.storage.

Security Disclosure#

• Zero Network: This skill does NOT perform any external network requests. All crypto operations happen via standard Web APIs in your browser.
• No Cleartext Keys: Keys are never stored in cleartext. They are always "wrapped" (encrypted) by a higher-level key.
• Passphrase Obligation: You must provide your passphrase to "unlock" the vault after هر reboot or session expiry. If you forget your passphrase, existing encrypted data is lost forever.

Selective Encryption#

Configure which scopes to protect in your settings:

• history: Conversation logs.
• memory: Agent's semantic memory.
• assets: All uploaded files.

Usage#

javascript

import { EncryptionService } from './encryption-service.js';

// Unlock once per session
await EncryptionService.unlock('your-passphrase');

// Use throughout the session
const secretData = await EncryptionService.encrypt('memory', 'Sensitive intelligence...');