fix(platform): Fix marketplace leaking secrets

[aarushik93]

Background

Marketplace wasn't implemented with secret hiding. It downloads the agent as is and then submits it as is, with secrets in cleartext.

Changes 🏗️

Made the graph endpoint hideable. Added query param to hide secrets, which should hide the input data in the nodes when fetching

Testing 🔍

Note

Only for the new autogpt platform, currently in autogpt_platform/

• Create from scratch and execute an agent with at least 3 blocks
• Import an agent from file upload, and confirm it executes correctly
• Upload agent to marketplace
• Import an agent from marketplace and confirm it executes correctly
• Edit an agent from monitor, and confirm it executes correctly

[qodo-merge-pro]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🧪 No relevant tests

🔒 Security concerns Sensitive information exposure: While the PR aims to hide secrets, the implementation in _hide_secrets_in_input method uses a predefined list of sensitive keys. This approach might not catch all types of secrets, especially if they have custom or uncommon names. Consider implementing a more robust secret detection mechanism or allowing custom configuration of sensitive keys.

⚡ Recommended focus areas for review Potential Bug The _hide_secrets_in_input method uses a hardcoded list of sensitive keys. This approach might miss some custom or less common sensitive information. Unused Variable The undefined parameter is passed to api.getGraph(), but it's not clear what this parameter represents or if it's necessary. Code Duplication The query string construction is duplicated. Consider refactoring this into a separate method for better maintainability.

[netlify]

✅ Deploy Preview for auto-gpt-docs canceled.

Name	Link
🔨 Latest commit	c03332e
🔍 Latest deploy log	https://app.netlify.com/sites/auto-gpt-docs/deploys/6705600c73493c0008203597

[Pwuts]

LGTM!