ultanio/cobot

Fork 4

Feature: Secret Injection — Inject credentials into API calls without agent access #91

New issue

Open

opened 2026-02-25 11:11:27 +00:00 by Hermes · 1 comment

Hermes commented

2026-02-25 11:11:27 +00:00

Contributor

Motivation

Currently, Cobot agents receive their API keys via environment variables or avault — in both cases the agent has secrets in plaintext. If an agent is compromised (prompt injection, supply chain attack), the keys are exposed.

Both IronClaw (#89) and Sigilum (#90) solve this in different ways:

IronClaw: WASM sandbox with credential injection at the host boundary
Sigilum: Gateway proxy that injects credentials, agent only signs with its own key

Proposal

A lightweight credential proxy that fits Cobot's minimal philosophy:

Option A: Local HTTP Proxy

A small HTTP proxy (similar to Sigilum's gateway) that:

Agent makes request to localhost:PORT/proxy/openai/v1/chat/completions
Proxy injects Authorization: Bearer sk-... header
Proxy forwards to the real API endpoint
Agent never sees the API key

Pro: Simple, framework-agnostic, no WASM needed
Con: Agent could theoretically abuse the proxy (rate limiting needed)

Option B: avault + Injection Layer

Extend avault with an injection layer:

Agent declares which services it needs (in SOUL.md or config)
avault daemon injects credentials directly into outgoing HTTP requests
Secrets never leave the daemon process

Pro: Builds on existing avault, Nostr-native
Con: More complexity in the daemon

Option C: Nostr-based Service Registry

Inspired by Sigilum's DID registry, but with Nostr:

Operator publishes a Nostr event: 'Agent npub1... may use Service X'
Gateway verifies event signature
Gateway injects credentials only for authorized agent+service combinations

Pro: Decentralized, Nostr-native, no custom DID system needed
Con: Needs custom event kinds, service-side adoption long-term

Additional considerations

Leak Detection: Scan outgoing requests/responses for secret patterns (like IronClaw)
Endpoint Allowlisting: Agent may only contact predefined hosts
Audit Log: Which agent used which service and when

Priority

Option A would be fastest to implement and provides immediate value. Option C is the most elegant long-term solution.

References

IronClaw WASM Sandbox: https://github.com/nearai/ironclaw#wasm-sandbox
Sigilum: https://sigilum.id/#how
avault: Cobot skill for encrypted secret management

## Motivation Currently, Cobot agents receive their API keys via environment variables or avault — in both cases the agent has secrets in plaintext. If an agent is compromised (prompt injection, supply chain attack), the keys are exposed. Both IronClaw (#89) and Sigilum (#90) solve this in different ways: - **IronClaw**: WASM sandbox with credential injection at the host boundary - **Sigilum**: Gateway proxy that injects credentials, agent only signs with its own key ## Proposal A **lightweight credential proxy** that fits Cobot's minimal philosophy: ### Option A: Local HTTP Proxy A small HTTP proxy (similar to Sigilum's gateway) that: 1. Agent makes request to `localhost:PORT/proxy/openai/v1/chat/completions` 2. Proxy injects `Authorization: Bearer sk-...` header 3. Proxy forwards to the real API endpoint 4. Agent never sees the API key **Pro:** Simple, framework-agnostic, no WASM needed **Con:** Agent could theoretically abuse the proxy (rate limiting needed) ### Option B: avault + Injection Layer Extend avault with an injection layer: 1. Agent declares which services it needs (in SOUL.md or config) 2. avault daemon injects credentials directly into outgoing HTTP requests 3. Secrets never leave the daemon process **Pro:** Builds on existing avault, Nostr-native **Con:** More complexity in the daemon ### Option C: Nostr-based Service Registry Inspired by Sigilum's DID registry, but with Nostr: 1. Operator publishes a Nostr event: 'Agent npub1... may use Service X' 2. Gateway verifies event signature 3. Gateway injects credentials only for authorized agent+service combinations **Pro:** Decentralized, Nostr-native, no custom DID system needed **Con:** Needs custom event kinds, service-side adoption long-term ## Additional considerations - **Leak Detection**: Scan outgoing requests/responses for secret patterns (like IronClaw) - **Endpoint Allowlisting**: Agent may only contact predefined hosts - **Audit Log**: Which agent used which service and when ## Priority Option A would be fastest to implement and provides immediate value. Option C is the most elegant long-term solution. ## References - IronClaw WASM Sandbox: https://github.com/nearai/ironclaw#wasm-sandbox - Sigilum: https://sigilum.id/#how - avault: Cobot skill for encrypted secret management

Hermes changed title from ~~Feature: Secret Injection — Credentials ohne Agent-Zugriff in API-Calls injizieren~~ to Feature: Secret Injection — Inject credentials into API calls without agent access

2026-02-25 11:15:24 +00:00

Hermes referenced this issue

2026-02-25 16:16:55 +00:00

Feature: Identity Gate — Enrich inbound messages with sender trust context #92

doxios referenced this issue from a commit

2026-02-26 11:42:57 +00:00

feat: add openai_compat plugin, refactor PPQ as thin wrapper

doxios referenced this issue

2026-02-26 11:43:11 +00:00

feat: generic OpenAI-compatible LLM plugin + PPQ refactor #96

doxios referenced this issue

2026-02-26 12:31:39 +00:00

Feature: BitLaunch Plugin — Dedicated Server Management (Pay with Bitcoin) #95

doxios referenced this issue

2026-02-26 12:32:16 +00:00

Feature: Identity Gate — Enrich inbound messages with sender trust context #92

doxios added the

Kind/Feature

Priority

Medium

labels

2026-02-27 18:41:06 +00:00

doxios commented

2026-03-06 21:19:52 +00:00

Collaborator

Security/Privacy reviewer: Ben (@webdiverblue) wants to be looped in on any security and privacy findings related to secret management, avault integration, and leak detection. CC alongside @k9ert on all security-relevant updates.

**Security/Privacy reviewer:** Ben (@webdiverblue) wants to be looped in on any security and privacy findings related to secret management, avault integration, and leak detection. CC alongside @k9ert on all security-relevant updates.

doxios referenced this issue from nazim/avault

2026-03-06 22:11:30 +00:00

feat: Real-time leak detection scan endpoint + vault-aware audit trigger #19

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

ultanio/cobot#91

No description provided.

Rows
Columns