agent-security

Agent Security

API Key Management

API keys are the #1 security failure in agent packaging. Every agent needs 1-8 API keys, and every one is a credential that can be leaked, logged, or stolen.

Environment Variables (Baseline)

export OPENAI_API_KEY="sk-..."
export ANTHROPIC_API_KEY="sk-ant-..."

api_key = os.environ.get("ANTHROPIC_API_KEY")
if not api_key:
    print("ANTHROPIC_API_KEY not set. Get one at: https://console.anthropic.com/keys")
    sys.exit(1)

Rules: Never print keys in logs (mask to sk-...abc). Never write keys to config files programmatically. Never include keys in crash reports or telemetry. Ship .env.example with empty values, never a .env with real keys.

OS Keychain Integration (Desktop Agents)

# macOS Keychain
security add-generic-password -a "my-agent" -s "OPENAI_API_KEY" -w "$KEY"
security find-generic-password -a "my-agent" -s "OPENAI_API_KEY" -w

# Cross-platform via keyring
import keyring
keyring.set_password("my-agent", "OPENAI_API_KEY", api_key)
api_key = keyring.get_password("my-agent", "OPENAI_API_KEY")

Keychain beats .env: keys are encrypted at rest, access is per-app, and the OS handles credential lifecycle.

.env Patterns

# .env.example (committed to repo)
OPENAI_API_KEY=
ANTHROPIC_API_KEY=
# Optional: CHROMA_URL=http://localhost:8000

# .gitignore (MUST include)
.env
.env.local
.env.*.local

---

Model Integrity

When your agent downloads model weights, treat them like executable code.

Checksum Verification

import hashlib

def verify_model(filepath, expected_sha256):
    sha256 = hashlib.sha256()
    with open(filepath, "rb") as f:
        for chunk in iter(lambda: f.read(8192), b""):
            sha256.update(chunk)
    if sha256.hexdigest() != expected_sha256:
        raise SecurityError("Model integrity check failed. Delete and re-download.")

Safe Serialization Formats

Format	Safe?	Notes
GGUF	Yes	llama.cpp format, no code execution
ONNX	Yes	Open standard, no arbitrary code
SafeTensors	Yes	Designed to prevent code execution
Pickle (.pkl, .pt)	NO	Executes arbitrary Python on load
Joblib	NO	Wraps pickle, same risk