The AEA framework takes every care to follow best practice around security.

The following advice will help you when writing your own code:

• Many potential common security vulnerabilities can be caught by static code analysis. We recommend you use safety, pylint and bandit to analyse your code.

• Don't use relative import paths, these can lead to malicious code being executed.

• Try to avoid using the subprocess module. If needed, make sure you sanitise commands passed to subprocess.

• Try to avoid using the pickle module. Pickle should never be used for agent-to-agent communication protocols.

• By design, the framework prevents skill code from accessing private keys directly, as they are not reachable from the skill execution context through attribute getters. However, if the flag -p or the option --password are not used when generating private keys for an AEA project via the AEA CLI tool, the private keys will be stored in plaintext. This allows the skills to access them via interaction with the OS file system. We recommend to always specify a password to encrypt private keys by using the flag argument.