ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-25 03:45:46 -06:00
Code Issues Packages Projects Releases Wiki Activity
Files
tmp/transcript-footnotes
openclaw/docs/security/THREAT-MODEL-ATLAS.md
T
Peter Steinberger d6b2e14f63 feat(cron): enable automation triggers by default (#125025) 
* feat(cron): enable automation triggers by default

Condition watchers, script payloads, and stream schedules were gated behind
cron.triggers.enabled=false, so the capability shipped dark and the automations
tool told the model to call it unsupported.

The gate did not buy what its warning implied. cronJobUsesToolRuntime treats
agentTurn, script, and trigger.script identically for tool policy, and jobs are
capped to the creating agent's allowlist via creatorToolAllowlist -- but an
agentTurn cron job was never gated, so unattended recurring exec with that same
creator-capped authority was already reachable. The gated paths are strictly
tighter: a condition gate gets 30s, 5 tool calls, 16KB state and a 30s minimum
interval, where an agentTurn has no such budget. Sandboxing already applies to
trigger scripts, which resolve sandbox context and redirect the workspace when
access is not rw.

Absent config now means enabled; an explicit cron.triggers.enabled: false still
disables every surface it disabled before, and the error text names the opt-out
instead of telling operators to turn something on. No new config key, no
migration.

Docs: reword the trigger warning for default-on while keeping the unattended
execution note, and record the new default in the configuration reference.

* test(cron): refresh prompt snapshots for default-on triggers

Trigger, stream-schedule, and script-payload surfaces are now advertised in the
automations tool description by default, so the committed fixtures drift.

This also records the cost: dynamicToolsJson grows 49,477 -> 52,541 chars and
the snapshot total 76,861 -> 79,925 (~766 rough tokens per prompt). That is the
price of no longer dark-shipping the capability.

* test(mcp): expect trigger surfaces by default in the tools bridge

The MCP tools bridge mirrors the scheduler gate, so an absent cron.triggers
config now advertises the trigger surface. Explicit false still narrows it and
explicit true still widens it; both assertions are unchanged.
2026-08-17 01:12:10 -07:00

562 lines
45 KiB
Markdown
Raw Permalink Blame History

---
summary: "OpenClaw threat model mapped to the MITRE ATLAS framework"
title: "Threat model (MITRE ATLAS)"
read_when:
- Reviewing security posture or threat scenarios
- Working on security features or audit responses
---
**Version:** 1.0-draft | **Framework:** [MITRE ATLAS](https://atlas.mitre.org/) (Adversarial Threat Landscape for AI Systems) + data flow diagrams
This threat model documents adversarial threats to the OpenClaw AI agent platform and ClawHub skill marketplace. It is a living document maintained by the OpenClaw community. See [Contributing to the threat model](/security/CONTRIBUTING-THREAT-MODEL) for how to report new threats, propose attack chains, or suggest mitigations.
**Key ATLAS resources:** [ATLAS website](https://atlas.mitre.org/) | [ATLAS data and contribution guide](https://github.com/mitre-atlas/atlas-data)
---
## 1. Scope
| Component | Included | Notes |
| ---------------------- | -------- | ------------------------------------------------ |
| OpenClaw agent runtime | Yes | Core agent execution, tool calls, sessions |
| Gateway | Yes | Authentication, routing, channel integration |
| Channel integrations | Yes | WhatsApp, Telegram, Discord, Signal, Slack, etc. |
| ClawHub marketplace | Yes | Skill publishing, moderation, distribution |
| MCP servers | Yes | External tool providers |
| User devices | Partial | Mobile apps, desktop clients |
Out-of-scope reports and false-positive patterns (public internet exposure, prompt-injection-only chains without a boundary bypass, mutually untrusted operators sharing one gateway host, and others) are enumerated in [`SECURITY.md`](https://github.com/openclaw/openclaw/blob/main/SECURITY.md); that file is the current source of truth for vulnerability-report scope, not this page.
## 2. System architecture
### 2.1 Trust boundaries
```text
┌─────────────────────────────────────────────────────────────────┐
│ UNTRUSTED ZONE │
│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │
│ │ WhatsApp │ │ Telegram │ │ Discord │ ... │
│ └──────┬──────┘ └──────┬──────┘ └──────┬──────┘ │
│ │ │ │ │
└─────────┼────────────────┼────────────────┼──────────────────────┘
│ │ │
▼ ▼ ▼
┌─────────────────────────────────────────────────────────────────┐
│ TRUST BOUNDARY 1: Channel Access │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ GATEWAY │ │
│ │ • Device pairing (1h DM pairing / 5m node pairing TTL) │ │
│ │ • AllowFrom / allowlist validation │ │
│ │ • Token / password / Tailscale auth │ │
│ └──────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ TRUST BOUNDARY 2: Session Isolation │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ AGENT SESSIONS │ │
│ │ • Session key = agent:channel:peer │ │
│ │ • Tool policies per agent │ │
│ │ • Transcript logging │ │
│ └──────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ TRUST BOUNDARY 3: Tool Execution │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ EXECUTION SANDBOX │ │
│ │ • Docker sandbox (default) or host (exec approvals) │ │
│ │ • Node remote execution │ │
│ │ • SSRF protection (DNS pinning + IP blocking) │ │
│ └──────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ TRUST BOUNDARY 4: External Content │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ FETCHED URLs / EMAILS / WEBHOOKS │ │
│ │ • External content wrapping (random-boundary XML tags) │ │
│ │ • Security notice injection │ │
│ └──────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ TRUST BOUNDARY 5: Supply Chain │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ CLAWHUB │ │
│ │ • Skill publishing (semver, SKILL.md required) │ │
│ │ • Static pattern + AST-adjacent moderation scanning │ │
│ │ • LLM-based agentic risk review + VirusTotal scanning │ │
│ │ • GitHub account age verification (14 days) │ │
│ └──────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
```
### 2.2 Data flows
| Flow | Source | Destination | Data | Protection |
| ---- | ------- | ----------- | -------------------- | -------------------- |
| F1 | Channel | Gateway | User messages | TLS, AllowFrom |
| F2 | Gateway | Agent | Routed messages | Session isolation |
| F3 | Agent | Tools | Tool invocations | Policy enforcement |
| F4 | Agent | External | `web_fetch` requests | SSRF blocking |
| F5 | ClawHub | Agent | Skill code | Moderation, scanning |
| F6 | Agent | Channel | Responses | Output filtering |
---
## 3. Threat analysis by ATLAS tactic
### 3.1 Reconnaissance (AML.TA0002)
#### T-RECON-001: Agent endpoint discovery
| Attribute | Value |
| ----------------------- | -------------------------------------------------------------------- |
| **ATLAS ID** | AML.T0006 - Active Scanning |
| **Description** | Attacker scans for exposed OpenClaw gateway endpoints |
| **Attack vector** | Network scanning, Shodan queries, DNS enumeration |
| **Affected components** | Gateway, exposed API endpoints |
| **Current mitigations** | Tailscale auth option, bind to loopback by default |
| **Residual risk** | Medium - public gateways discoverable |
| **Recommendations** | Document secure deployment, add rate limiting on discovery endpoints |
#### T-RECON-002: Channel integration probing
| Attribute | Value |
| ----------------------- | ------------------------------------------------------------------ |
| **ATLAS ID** | AML.T0006 - Active Scanning |
| **Description** | Attacker probes messaging channels to identify AI-managed accounts |
| **Attack vector** | Sending test messages, observing response patterns |
| **Affected components** | All channel integrations |
| **Current mitigations** | None specific |
| **Residual risk** | Low - limited value from discovery alone |
| **Recommendations** | Consider response timing randomization |
---
### 3.2 Initial access (AML.TA0004)
#### T-ACCESS-001: Pairing code interception
| Attribute | Value |
| ----------------------- | ----------------------------------------------------------------------------------------------------- |
| **ATLAS ID** | AML.T0040 - AI Model Inference API Access |
| **Description** | Attacker intercepts a pairing code during the pairing window (1h DM/generic pairing, 5m node pairing) |
| **Attack vector** | Shoulder surfing, network sniffing, social engineering |
| **Affected components** | Device pairing system |
| **Current mitigations** | 1h TTL (DM/generic pairing), 5m TTL (node pairing); codes sent via the existing channel |
| **Residual risk** | Medium - pairing window exploitable |
| **Recommendations** | Reduce pairing window, add a confirmation step |
#### T-ACCESS-002: AllowFrom spoofing
| Attribute | Value |
| ----------------------- | ------------------------------------------------------------------------------ |
| **ATLAS ID** | AML.T0040 - AI Model Inference API Access |
| **Description** | Attacker spoofs an allowed sender identity on a channel |
| **Attack vector** | Channel-dependent - phone number spoofing, username impersonation |
| **Affected components** | Per-channel AllowFrom validation |
| **Current mitigations** | Channel-specific identity verification |
| **Residual risk** | Medium - some channels remain vulnerable to spoofing |
| **Recommendations** | Document channel-specific risks, add cryptographic verification where possible |
#### T-ACCESS-003: Token theft
| Attribute | Value |
| ----------------------- | ------------------------------------------------------------------ |
| **ATLAS ID** | AML.T0040 - AI Model Inference API Access |
| **Description** | Attacker steals authentication tokens from config/credential files |
| **Attack vector** | Malware, unauthorized device access, config backup exposure |
| **Affected components** | Channel/provider credential storage, config storage |
| **Current mitigations** | File permissions |
| **Residual risk** | High - tokens stored in plaintext on disk |
| **Recommendations** | Implement token encryption at rest, add token rotation |
---
### 3.3 Execution (AML.TA0005)
#### T-EXEC-001: Direct prompt injection
| Attribute | Value |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **ATLAS ID** | AML.T0051.000 - LLM Prompt Injection: Direct |
| **Description** | Attacker sends crafted prompts to manipulate agent behavior |
| **Attack vector** | Channel messages containing adversarial instructions |
| **Affected components** | Agent LLM, all input surfaces |
| **Current mitigations** | Pattern detection, external content wrapping, and frontier-model robustness (2026 crowdsourced arena: 0.5% ASR on Claude Opus 4.5, 8.5% on Gemini 2.5 Pro, scored on execution plus concealment); treated as out-of-scope for vulnerability reports absent a boundary bypass (see `SECURITY.md`) |
| **Residual risk** | Model-tier dependent - low single-digit ASR against organic attacks on recommended frontier models, but adaptive attackers still exceed 80% against state-of-the-art defenses, and smaller/older models remain markedly easier to steer |
| **Recommendations** | Output validation and user confirmation for sensitive actions, layered on top of existing detection |
#### T-EXEC-002: Indirect prompt injection
| Attribute | Value |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **ATLAS ID** | AML.T0051.001 - LLM Prompt Injection: Indirect |
| **Description** | Attacker embeds malicious instructions in fetched content |
| **Attack vector** | Malicious URLs, poisoned emails, compromised webhooks |
| **Affected components** | `web_fetch`, email ingestion, external data sources |
| **Current mitigations** | Content wrapping with random-boundary XML-style markers, homoglyph/special-token normalization, a security notice, and frontier-model robustness (see T-EXEC-001) |
| **Residual risk** | Model-tier dependent - recommended frontier models largely hold the wrapper boundary, but it remains soft guidance an adaptive attacker can erode; scope tool policy and sandboxing to the blast radius you accept |
| **Recommendations** | Separate execution contexts for wrapped content |
#### T-EXEC-003: Tool argument injection
| Attribute | Value |
| ----------------------- | ------------------------------------------------------------ |
| **ATLAS ID** | AML.T0051.000 - LLM Prompt Injection: Direct |
| **Description** | Attacker manipulates tool arguments through prompt injection |
| **Attack vector** | Crafted prompts that influence tool parameter values |
| **Affected components** | All tool invocations |
| **Current mitigations** | Exec approvals for dangerous commands |
| **Residual risk** | High - relies on user judgment |
| **Recommendations** | Argument validation, parameterized tool calls |
#### T-EXEC-004: Exec approval bypass
| Attribute | Value |
| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **ATLAS ID** | AML.T0043 - Craft Adversarial Data |
| **Description** | Attacker crafts commands that bypass the approval allowlist |
| **Attack vector** | Command obfuscation, alias exploitation, path manipulation |
| **Affected components** | `src/infra/exec-approvals*.ts`, command allowlist |
| **Current mitigations** | Allowlist + ask mode, plus command normalization (dispatch-wrapper unwrapping, inline-eval detection, shell-chain analysis) |
| **Residual risk** | High - normalization narrows but does not eliminate obfuscation bypass; parity-only findings between exec paths are treated as hardening, not vulnerabilities (see `SECURITY.md`) |
| **Recommendations** | Continue expanding command-normalization coverage against new obfuscation techniques |
---
### 3.4 Persistence (AML.TA0006)
#### T-PERSIST-001: Malicious skill installation
| Attribute | Value |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| **ATLAS ID** | AML.T0010.001 - Supply Chain Compromise: AI Software |
| **Description** | Attacker publishes a malicious skill to ClawHub |
| **Attack vector** | Create account, publish skill with hidden malicious code |
| **Affected components** | ClawHub, skill loading, agent execution |
| **Current mitigations** | GitHub account age verification, static pattern/AST-adjacent scanning, LLM-based agentic risk review, VirusTotal scanning |
| **Residual risk** | High - detection layers exist but skills still run with agent privileges and no execution sandboxing |
| **Recommendations** | Skill execution sandboxing, expanded community review |
#### T-PERSIST-002: Skill update poisoning
| Attribute | Value |
| ----------------------- | ----------------------------------------------------------------------- |
| **ATLAS ID** | AML.T0010.001 - Supply Chain Compromise: AI Software |
| **Description** | Attacker compromises a popular skill and pushes a malicious update |
| **Attack vector** | Account compromise, social engineering of skill owner |
| **Affected components** | ClawHub versioning, auto-update flows |
| **Current mitigations** | Version fingerprinting, moderation/scanning re-run on new versions |
| **Residual risk** | High - auto-updates may pull malicious versions before review completes |
| **Recommendations** | Update signing, rollback capability, version pinning |
#### T-PERSIST-003: Agent configuration tampering
| Attribute | Value |
| ----------------------- | --------------------------------------------------------------- |
| **ATLAS ID** | AML.T0010.002 - Supply Chain Compromise: Data |
| **Description** | Attacker modifies agent configuration to persist access |
| **Attack vector** | Config file modification, settings injection |
| **Affected components** | Agent config, tool policies |
| **Current mitigations** | File permissions |
| **Residual risk** | Medium - requires local access |
| **Recommendations** | Config integrity verification, audit logging for config changes |
---
### 3.5 Defense evasion (AML.TA0007)
#### T-EVADE-001: Moderation pattern bypass
| Attribute | Value |
| ----------------------- | ------------------------------------------------------------------------------------- |
| **ATLAS ID** | AML.T0043 - Craft Adversarial Data |
| **Description** | Attacker crafts skill content to evade ClawHub moderation checks |
| **Attack vector** | Unicode homoglyphs, encoding tricks, dynamic loading |
| **Affected components** | ClawHub moderation/scanning pipeline |
| **Current mitigations** | Static pattern rules, AST-adjacent code scanning, LLM agentic-risk review, VirusTotal |
| **Residual risk** | Medium - novel obfuscation can still slip past layered heuristics |
| **Recommendations** | Continue expanding the pattern/behavioral corpus as new evasions are found |
#### T-EVADE-002: Content wrapper escape
| Attribute | Value |
| ----------------------- | ------------------------------------------------------------------------------------------------------------- |
| **ATLAS ID** | AML.T0043 - Craft Adversarial Data |
| **Description** | Attacker crafts content that escapes the external-content wrapper context |
| **Attack vector** | Tag manipulation, context confusion, instruction override |
| **Affected components** | External content wrapping |
| **Current mitigations** | Random-boundary XML-style markers + security notice, plus homoglyph/whitespace-variant marker-spoof detection |
| **Residual risk** | Medium - novel escapes discovered regularly |
| **Recommendations** | Output-side validation in addition to input-side wrapping |
---
### 3.6 Discovery (AML.TA0008)
#### T-DISC-001: Tool enumeration
| Attribute | Value |
| ----------------------- | ----------------------------------------------------- |
| **ATLAS ID** | AML.T0040 - AI Model Inference API Access |
| **Description** | Attacker enumerates available tools through prompting |
| **Attack vector** | "What tools do you have?" style queries |
| **Affected components** | Agent tool registry |
| **Current mitigations** | None specific |
| **Residual risk** | Low - tools are generally documented |
| **Recommendations** | Consider tool visibility controls |
#### T-DISC-002: Session data extraction
| Attribute | Value |
| ----------------------- | ------------------------------------------------------- |
| **ATLAS ID** | AML.T0040 - AI Model Inference API Access |
| **Description** | Attacker extracts sensitive data from session context |
| **Attack vector** | "What did we discuss?" queries, context probing |
| **Affected components** | Session transcripts, context window |
| **Current mitigations** | Session isolation per sender (`agent:channel:peer` key) |
| **Residual risk** | Medium - within-session data is accessible by design |
| **Recommendations** | Sensitive-data redaction in context |
---
### 3.7 Collection and exfiltration (AML.TA0009, AML.TA0010)
#### T-EXFIL-001: Data theft via web_fetch
| Attribute | Value |
| ----------------------- | -------------------------------------------------------------------------------- |
| **ATLAS ID** | AML.T0009 - Collection |
| **Description** | Attacker exfiltrates data by instructing the agent to send it to an external URL |
| **Attack vector** | Prompt injection causing the agent to POST data to an attacker server |
| **Affected components** | `web_fetch` tool |
| **Current mitigations** | SSRF blocking for internal/private networks (DNS pinning + IP blocking) |
| **Residual risk** | High - arbitrary external URLs remain permitted |
| **Recommendations** | URL allowlisting, data-classification awareness |
#### T-EXFIL-002: Unauthorized message sending
| Attribute | Value |
| ----------------------- | -------------------------------------------------------------------- |
| **ATLAS ID** | AML.T0009 - Collection |
| **Description** | Attacker causes the agent to send messages containing sensitive data |
| **Attack vector** | Prompt injection causing the agent to message the attacker |
| **Affected components** | Message tool, channel integrations |
| **Current mitigations** | Outbound messaging gating |
| **Residual risk** | Medium - gating may be bypassed |
| **Recommendations** | Explicit confirmation for new recipients |
#### T-EXFIL-003: Credential harvesting
| Attribute | Value |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **ATLAS ID** | AML.T0009 - Collection |
| **Description** | Malicious skill harvests credentials from the agent context |
| **Attack vector** | Skill code reads environment variables, config files |
| **Affected components** | Skill execution environment |
| **Current mitigations** | ClawHub credential-pattern scanning (hardcoded secrets, credential env access paired with network sends); no execution sandboxing for skills at runtime |
| **Residual risk** | Critical - skills run with agent privileges |
| **Recommendations** | Skill execution sandboxing, credential isolation |
---
### 3.8 Impact (AML.TA0011)
#### T-IMPACT-001: Unauthorized command execution
| Attribute | Value |
| ----------------------- | ---------------------------------------------------------------------------------------------------- |
| **ATLAS ID** | AML.T0031 - Erode AI Model Integrity |
| **Description** | Attacker executes arbitrary commands on the user system |
| **Attack vector** | Prompt injection combined with exec approval bypass |
| **Affected components** | Bash tool, command execution |
| **Current mitigations** | Exec approvals, Docker sandbox option (default runtime backend) |
| **Residual risk** | Critical - host execution possible when sandbox is disabled |
| **Recommendations** | Improve approval UX; sandbox-off deployments remain a deliberate operator choice, documented as such |
#### T-IMPACT-002: Resource exhaustion (DoS)
| Attribute | Value |
| ----------------------- | -------------------------------------------------- |
| **ATLAS ID** | AML.T0031 - Erode AI Model Integrity |
| **Description** | Attacker exhausts API credits or compute resources |
| **Attack vector** | Automated message flooding, expensive tool calls |
| **Affected components** | Gateway, agent sessions, API provider |
| **Current mitigations** | None |
| **Residual risk** | High - no per-sender rate limiting |
| **Recommendations** | Per-sender rate limits, cost budgets |
#### T-IMPACT-003: Reputation damage
| Attribute | Value |
| ----------------------- | ----------------------------------------------------------- |
| **ATLAS ID** | AML.T0031 - Erode AI Model Integrity |
| **Description** | Attacker causes the agent to send harmful/offensive content |
| **Attack vector** | Prompt injection causing inappropriate responses |
| **Affected components** | Output generation, channel messaging |
| **Current mitigations** | LLM provider content policies |
| **Residual risk** | Medium - provider filters are imperfect |
| **Recommendations** | Output filtering layer, user controls |
---
## 4. ClawHub supply chain analysis
### 4.1 Current security controls
| Control | Implementation | Effectiveness |
| ------------------------------ | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
| GitHub account age | `requireGitHubAccountAge()` (14-day minimum) | Medium - raises the bar for new attackers |
| Path sanitization | `sanitizePath()` | High - prevents path traversal |
| File type validation | `isTextFile()` | Medium - only text files scanned, but still exploitable |
| Size limits | 50MB total bundle (`MAX_PUBLISH_TOTAL_BYTES`) | High - prevents resource exhaustion |
| Required SKILL.md | Mandatory readme on publish | Low security value - informational only |
| Static + AST-adjacent scanning | Pattern engine covering exec, exfiltration, credential-harvest, obfuscation, and more | Medium-High - covers many known abuse patterns, still pattern-based |
| LLM-based agentic risk review | Security-prompt-driven verdict on publish | Medium-High - catches behavior static patterns miss |
| VirusTotal scanning | Wired to skill and package-release publish/rescan flows, gated on operator API key | High when enabled - static engine detection |
| Moderation status | `moderationStatus` field | Medium - manual review possible |
### 4.2 Moderation limitations
ClawHub's static scanning inspects skill code content directly (not just slug/metadata/frontmatter), covering dangerous exec calls, dynamic code execution, credential harvesting, exfiltration patterns, obfuscated payloads, and more. Known gaps:
- Pattern-based detection can still be bypassed by sufficiently novel obfuscation.
- LLM-based review and VirusTotal scanning depend on operator-side API keys/config being enabled.
- No runtime execution sandbox isolates a skill from the agent's own privileges once installed.
### 4.3 Badges
Skills and packages carry moderator-assigned badges: `highlighted`, `official`, `deprecated`, `redactionApproved` (skills only). Community reporting (`skillReports`) and audit logging (`auditLogs`) back moderation workflows.
---
## 5. Risk matrix
### 5.1 Likelihood vs impact
| Threat ID | Likelihood | Impact | Risk level | Priority |
| ------------- | ---------- | -------- | ------------ | -------- |
| T-EXEC-001 | High | Critical | **Critical** | P0 |
| T-PERSIST-001 | High | Critical | **Critical** | P0 |
| T-EXFIL-003 | Medium | Critical | **Critical** | P0 |
| T-IMPACT-001 | Medium | Critical | **High** | P1 |
| T-EXEC-002 | High | High | **High** | P1 |
| T-EXEC-004 | Medium | High | **High** | P1 |
| T-ACCESS-003 | Medium | High | **High** | P1 |
| T-EXFIL-001 | Medium | High | **High** | P1 |
| T-IMPACT-002 | High | Medium | **High** | P1 |
| T-EVADE-001 | High | Medium | **Medium** | P2 |
| T-ACCESS-001 | Low | High | **Medium** | P2 |
| T-ACCESS-002 | Low | High | **Medium** | P2 |
| T-PERSIST-002 | Low | High | **Medium** | P2 |
### 5.2 Critical path attack chains
**Chain 1: Skill-based data theft**
```text
T-PERSIST-001 → T-EVADE-001 → T-EXFIL-003
(Publish malicious skill) → (Evade moderation) → (Harvest credentials)
```
**Chain 2: Prompt injection to RCE**
```text
T-EXEC-001 → T-EXEC-004 → T-IMPACT-001
(Inject prompt) → (Bypass exec approval) → (Execute commands)
```
**Chain 3: Indirect injection via fetched content**
```text
T-EXEC-002 → T-EXFIL-001 → External exfiltration
(Poison URL content) → (Agent fetches & follows instructions) → (Data sent to attacker)
```
---
## 6. Recommendations summary
### 6.1 Immediate (P0)
| ID | Recommendation | Addresses |
| ----- | ------------------------------------------- | -------------------------- |
| R-002 | Implement skill execution sandboxing | T-PERSIST-001, T-EXFIL-003 |
| R-003 | Add output validation for sensitive actions | T-EXEC-001, T-EXEC-002 |
### 6.2 Short-term (P1)
| ID | Recommendation | Addresses |
| ----- | --------------------------------------------------------------------- | ------------ |
| R-004 | Implement per-sender rate limiting | T-IMPACT-002 |
| R-005 | Add token encryption at rest | T-ACCESS-003 |
| R-006 | Improve exec approval UX and continue expanding command normalization | T-EXEC-004 |
| R-007 | Implement URL allowlisting for `web_fetch` | T-EXFIL-001 |
### 6.3 Medium-term (P2)
| ID | Recommendation | Addresses |
| ----- | ----------------------------------------------------- | ------------- |
| R-008 | Add cryptographic channel verification where possible | T-ACCESS-002 |
| R-009 | Implement config integrity verification | T-PERSIST-003 |
| R-010 | Add update signing and version pinning | T-PERSIST-002 |
---
## 7. Appendices
### 7.1 ATLAS technique mapping
| ATLAS ID | Technique name | OpenClaw threats |
| ------------- | ------------------------------ | ---------------------------------------------------------------- |
| AML.T0006 | Active Scanning | T-RECON-001, T-RECON-002 |
| AML.T0009 | Collection | T-EXFIL-001, T-EXFIL-002, T-EXFIL-003 |
| AML.T0010.001 | Supply Chain: AI Software | T-PERSIST-001, T-PERSIST-002 |
| AML.T0010.002 | Supply Chain: Data | T-PERSIST-003 |
| AML.T0031 | Erode AI Model Integrity | T-IMPACT-001, T-IMPACT-002, T-IMPACT-003 |
| AML.T0040 | AI Model Inference API Access | T-ACCESS-001, T-ACCESS-002, T-ACCESS-003, T-DISC-001, T-DISC-002 |
| AML.T0043 | Craft Adversarial Data | T-EXEC-004, T-EVADE-001, T-EVADE-002 |
| AML.T0051.000 | LLM Prompt Injection: Direct | T-EXEC-001, T-EXEC-003 |
| AML.T0051.001 | LLM Prompt Injection: Indirect | T-EXEC-002 |
### 7.2 Key security files
| Path | Purpose | Risk level |
| ----------------------------------- | ------------------------------ | ------------ |
| `src/infra/exec-approvals.ts` | Command approval logic | **Critical** |
| `src/gateway/auth.ts` | Gateway authentication | **Critical** |
| `src/infra/net/ssrf.ts` | SSRF protection | **Critical** |
| `src/security/external-content.ts` | Prompt injection mitigation | **Critical** |
| `src/agents/sandbox/tool-policy.ts` | Sandbox tool allow/deny policy | **Critical** |
| `src/routing/resolve-route.ts` | Session isolation / routing | **Medium** |
### 7.3 Glossary
| Term | Definition |
| -------------------- | --------------------------------------------------------- |
| **ATLAS** | MITRE's Adversarial Threat Landscape for AI Systems |
| **ClawHub** | OpenClaw's skill marketplace |
| **Gateway** | OpenClaw's message routing and authentication layer |
| **MCP** | Model Context Protocol - tool provider interface |
| **Prompt injection** | Attack where malicious instructions are embedded in input |
| **Skill** | Downloadable extension for OpenClaw agents |
| **SSRF** | Server-Side Request Forgery |
---
_This threat model is a living document. Report security issues to `security@openclaw.ai` or see the [Trust page](https://trust.openclaw.ai)._
## Related
- [Contributing to the threat model](/security/CONTRIBUTING-THREAT-MODEL)
- [Incident response](/security/incident-response)
- [Network proxy](/security/network-proxy)
- [Formal verification](/security/formal-verification)
Reference in New Issue View Git Blame Copy Permalink