* refactor(imap): consume the core identifier-authentication scale
Use the SDK type and canonical strength comparator instead of the private
SenderStrength vocabulary and index ordering. Bind config values to the SDK
union with a compile-time exhaustiveness check, preserving all config keys.
Classify unproven From ownership, including no-evidence and DMARC temperror
results, as unverified. Only an explicit unverified minimum gains admission;
the default verified floor and asserted minimum keep their behavior. Keep
existing token admission and thrown-authenticator retries unchanged.
Document the remaining mutable token/early-rejection paths and expose only
the canonical comparator through the SDK, with packaged-consumer coverage.
The IMAP introduction has no stable release contract.
* docs(security): record landed sender-auth mitigations in the threat atlas
Record the graded exact-pair identifier-authentication gate and inert mutable
allowFrom audit findings. Mark R-008 implemented in core while retaining
per-channel verified adoption and downstream mappers as remaining work.
Keep the existing atlas structure and Medium residual risk.
OpenClaw threat model mapped to the MITRE ATLAS framework
Threat model (MITRE ATLAS)
Reviewing security posture or threat scenarios
Working on security features or audit responses
Version: 1.0-draft | Framework:MITRE ATLAS (Adversarial Threat Landscape for AI Systems) + data flow diagrams
This threat model documents adversarial threats to the OpenClaw AI agent platform and ClawHub skill marketplace. It is a living document maintained by the OpenClaw community. See Contributing to the threat model for how to report new threats, propose attack chains, or suggest mitigations.
Out-of-scope reports and false-positive patterns (public internet exposure, prompt-injection-only chains without a boundary bypass, mutually untrusted operators sharing one gateway host, and others) are enumerated in SECURITY.md; that file is the current source of truth for vulnerability-report scope, not this page.
Pattern detection, external content wrapping, and frontier-model robustness (2026 crowdsourced arena: 0.5% ASR on Claude Opus 4.5, 8.5% on Gemini 2.5 Pro, scored on execution plus concealment); treated as out-of-scope for vulnerability reports absent a boundary bypass (see SECURITY.md)
Residual risk
Model-tier dependent - low single-digit ASR against organic attacks on recommended frontier models, but adaptive attackers still exceed 80% against state-of-the-art defenses, and smaller/older models remain markedly easier to steer
Recommendations
Output validation and user confirmation for sensitive actions, layered on top of existing detection
T-EXEC-002: Indirect prompt injection
Attribute
Value
ATLAS ID
AML.T0051.001 - LLM Prompt Injection: Indirect
Description
Attacker embeds malicious instructions in fetched content
Content wrapping with random-boundary XML-style markers, homoglyph/special-token normalization, a security notice, and frontier-model robustness (see T-EXEC-001)
Residual risk
Model-tier dependent - recommended frontier models largely hold the wrapper boundary, but it remains soft guidance an adaptive attacker can erode; scope tool policy and sandboxing to the blast radius you accept
Recommendations
Separate execution contexts for wrapped content
T-EXEC-003: Tool argument injection
Attribute
Value
ATLAS ID
AML.T0051.000 - LLM Prompt Injection: Direct
Description
Attacker manipulates tool arguments through prompt injection
Attack vector
Crafted prompts that influence tool parameter values
Affected components
All tool invocations
Current mitigations
Exec approvals for dangerous commands
Residual risk
High - relies on user judgment
Recommendations
Argument validation, parameterized tool calls
T-EXEC-004: Exec approval bypass
Attribute
Value
ATLAS ID
AML.T0043 - Craft Adversarial Data
Description
Attacker crafts commands that bypass the approval allowlist
Attack vector
Command obfuscation, alias exploitation, path manipulation
High - normalization narrows but does not eliminate obfuscation bypass; parity-only findings between exec paths are treated as hardening, not vulnerabilities (see SECURITY.md)
Recommendations
Continue expanding command-normalization coverage against new obfuscation techniques
3.4 Persistence (AML.TA0006)
T-PERSIST-001: Malicious skill installation
Attribute
Value
ATLAS ID
AML.T0010.001 - Supply Chain Compromise: AI Software
Description
Attacker publishes a malicious skill to ClawHub
Attack vector
Create account, publish skill with hidden malicious code
ClawHub credential-pattern scanning (hardcoded secrets, credential env access paired with network sends); no execution sandboxing for skills at runtime
Residual risk
Critical - skills run with agent privileges
Recommendations
Skill execution sandboxing, credential isolation
3.8 Impact (AML.TA0011)
T-IMPACT-001: Unauthorized command execution
Attribute
Value
ATLAS ID
AML.T0031 - Erode AI Model Integrity
Description
Attacker executes arbitrary commands on the user system
Attack vector
Prompt injection combined with exec approval bypass
T-EXEC-002 → T-EXFIL-001 → External exfiltration
(Poison URL content) → (Agent fetches & follows instructions) → (Data sent to attacker)
6. Recommendations summary
6.1 Immediate (P0)
ID
Recommendation
Addresses
R-002
Implement skill execution sandboxing
T-PERSIST-001, T-EXFIL-003
R-003
Add output validation for sensitive actions
T-EXEC-001, T-EXEC-002
6.2 Short-term (P1)
ID
Recommendation
Addresses
R-004
Implement per-sender rate limiting
T-IMPACT-002
R-005
Add token encryption at rest
T-ACCESS-003
R-006
Improve exec approval UX and continue expanding command normalization
T-EXEC-004
R-007
Implement URL allowlisting for web_fetch
T-EXFIL-001
6.3 Medium-term (P2)
ID
Recommendation
Addresses
R-008
Implemented in core: graded identifier-authentication primitive and audit findings; remaining work is per-channel verified adoption and downstream strength mappers
Peter Steinberger
77746299ea