OpenClawDocs
View as MarkdownView this page as plain textOpen in ChatGPTAsk questions about this pageOpen in ClaudeAsk questions about this page

Security

Threat model (MITRE ATLAS)

Version: 1.0-draft | Framework: MITRE ATLAS (Adversarial Threat Landscape for AI Systems) + data flow diagrams

This threat model documents adversarial threats to the OpenClaw AI agent platform and ClawHub skill marketplace. It is a living document maintained by the OpenClaw community. See Contributing to the threat model for how to report new threats, propose attack chains, or suggest mitigations.

Key ATLAS resources: ATLAS website | ATLAS data and contribution guide

1. Scope

Component Included Notes
OpenClaw agent runtime Yes Core agent execution, tool calls, sessions
Gateway Yes Authentication, routing, channel integration
Channel integrations Yes WhatsApp, Telegram, Discord, Signal, Slack, etc.
ClawHub marketplace Yes Skill publishing, moderation, distribution
MCP servers Yes External tool providers
User devices Partial Mobile apps, desktop clients

Out-of-scope reports and false-positive patterns (public internet exposure, prompt-injection-only chains without a boundary bypass, mutually untrusted operators sharing one gateway host, and others) are enumerated in SECURITY.md; that file is the current source of truth for vulnerability-report scope, not this page.

2. System architecture

2.1 Trust boundaries

text
┌─────────────────────────────────────────────────────────────────┐│                    UNTRUSTED ZONE                                ││  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐              ││  │  WhatsApp   │  │  Telegram   │  │   Discord   │  ...         ││  └──────┬──────┘  └──────┬──────┘  └──────┬──────┘              ││         │                │                │                      │└─────────┼────────────────┼────────────────┼──────────────────────┘          │                │                │          ▼                ▼                ▼┌─────────────────────────────────────────────────────────────────┐│                 TRUST BOUNDARY 1: Channel Access                 ││  ┌──────────────────────────────────────────────────────────┐   ││  │                      GATEWAY                              │   ││  │  • Device pairing (1h DM pairing / 5m node pairing TTL)   │   ││  │  • AllowFrom / allowlist validation                       │   ││  │  • Token / password / Tailscale auth                      │   ││  └──────────────────────────────────────────────────────────┘   │└─────────────────────────────────────────────────────────────────┘                              │                              ▼┌─────────────────────────────────────────────────────────────────┐│                 TRUST BOUNDARY 2: Session Isolation              ││  ┌──────────────────────────────────────────────────────────┐   ││  │                   AGENT SESSIONS                          │   ││  │  • Session key = agent:channel:peer                       │   ││  │  • Tool policies per agent                                │   ││  │  • Transcript logging                                     │   ││  └──────────────────────────────────────────────────────────┘   │└─────────────────────────────────────────────────────────────────┘                              │                              ▼┌─────────────────────────────────────────────────────────────────┐│                 TRUST BOUNDARY 3: Tool Execution                 ││  ┌──────────────────────────────────────────────────────────┐   ││  │                  EXECUTION SANDBOX                        │   ││  │  • Docker sandbox (default) or host (exec approvals)      │   ││  │  • Node remote execution                                  │   ││  │  • SSRF protection (DNS pinning + IP blocking)            │   ││  └──────────────────────────────────────────────────────────┘   │└─────────────────────────────────────────────────────────────────┘                              │                              ▼┌─────────────────────────────────────────────────────────────────┐│                 TRUST BOUNDARY 4: External Content               ││  ┌──────────────────────────────────────────────────────────┐   ││  │              FETCHED URLs / EMAILS / WEBHOOKS             │   ││  │  • External content wrapping (random-boundary XML tags)   │   ││  │  • Security notice injection                              │   ││  └──────────────────────────────────────────────────────────┘   │└─────────────────────────────────────────────────────────────────┘                              │                              ▼┌─────────────────────────────────────────────────────────────────┐│                 TRUST BOUNDARY 5: Supply Chain                   ││  ┌──────────────────────────────────────────────────────────┐   ││  │                      CLAWHUB                              │   ││  │  • Skill publishing (semver, SKILL.md required)           │   ││  │  • Static pattern + AST-adjacent moderation scanning      │   ││  │  • LLM-based agentic risk review + VirusTotal scanning    │   ││  │  • GitHub account age verification (14 days)              │   ││  └──────────────────────────────────────────────────────────┘   │└─────────────────────────────────────────────────────────────────┘

2.2 Data flows

Flow Source Destination Data Protection
F1 Channel Gateway User messages TLS, AllowFrom
F2 Gateway Agent Routed messages Session isolation
F3 Agent Tools Tool invocations Policy enforcement
F4 Agent External web_fetch requests SSRF blocking
F5 ClawHub Agent Skill code Moderation, scanning
F6 Agent Channel Responses Output filtering

3. Threat analysis by ATLAS tactic

The threat catalog is split by ATLAS tactic. Each page below holds the full attribute table for every threat in that tactic. The risk matrix in section 5 and the recommendations summary in section 6 index across all of them, and the ATLAS technique mapping in section 7.1 lists which threats implement each technique.

ATLAS tactic Threats Page
Reconnaissance (AML.TA0002) T-RECON-001, T-RECON-002 Reconnaissance
Initial access (AML.TA0004) T-ACCESS-001, T-ACCESS-002, T-ACCESS-003 Initial access
Execution (AML.TA0005) T-EXEC-001, T-EXEC-002, T-EXEC-003, T-EXEC-004 Execution
Persistence (AML.TA0006) T-PERSIST-001, T-PERSIST-002, T-PERSIST-003 Persistence
Defense evasion (AML.TA0007) T-EVADE-001, T-EVADE-002 Defense evasion
Discovery (AML.TA0008) T-DISC-001, T-DISC-002 Discovery
Collection and exfiltration (AML.TA0009, AML.TA0010) T-EXFIL-001, T-EXFIL-002, T-EXFIL-003 Collection and exfiltration
Impact (AML.TA0011) T-IMPACT-001, T-IMPACT-002, T-IMPACT-003 Impact

4. ClawHub supply chain analysis

4.1 Current security controls

Control Implementation Effectiveness
GitHub account age requireGitHubAccountAge() (14-day minimum) Medium - raises the bar for new attackers
Path sanitization sanitizePath() High - prevents path traversal
File type validation isTextFile() Medium - only text files scanned, but still exploitable
Size limits 50MB total bundle (MAX_PUBLISH_TOTAL_BYTES) High - prevents resource exhaustion
Required SKILL.md Mandatory readme on publish Low security value - informational only
Static + AST-adjacent scanning Pattern engine covering exec, exfiltration, credential-harvest, obfuscation, and more Medium-High - covers many known abuse patterns, still pattern-based
LLM-based agentic risk review Security-prompt-driven verdict on publish Medium-High - catches behavior static patterns miss
VirusTotal scanning Wired to skill and package-release publish/rescan flows, gated on operator API key High when enabled - static engine detection
Moderation status moderationStatus field Medium - manual review possible

4.2 Moderation limitations

ClawHub's static scanning inspects skill code content directly (not just slug/metadata/frontmatter), covering dangerous exec calls, dynamic code execution, credential harvesting, exfiltration patterns, obfuscated payloads, and more. Known gaps:

  • Pattern-based detection can still be bypassed by sufficiently novel obfuscation.
  • LLM-based review and VirusTotal scanning depend on operator-side API keys/config being enabled.
  • No runtime execution sandbox isolates a skill from the agent's own privileges once installed.

4.3 Badges

Skills and packages carry moderator-assigned badges: highlighted, official, deprecated, redactionApproved (skills only). Community reporting (skillReports) and audit logging (auditLogs) back moderation workflows.

5. Risk matrix

5.1 Likelihood vs impact

Threat ID Likelihood Impact Risk level Priority
T-EXEC-001 High Critical Critical P0
T-PERSIST-001 High Critical Critical P0
T-EXFIL-003 Medium Critical Critical P0
T-IMPACT-001 Medium Critical High P1
T-EXEC-002 High High High P1
T-EXEC-004 Medium High High P1
T-ACCESS-003 Medium High High P1
T-EXFIL-001 Medium High High P1
T-IMPACT-002 High Medium High P1
T-EVADE-001 High Medium Medium P2
T-ACCESS-001 Low High Medium P2
T-ACCESS-002 Low High Medium P2
T-PERSIST-002 Low High Medium P2

5.2 Critical path attack chains

Chain 1: Skill-based data theft

text
T-PERSIST-001 → T-EVADE-001 → T-EXFIL-003(Publish malicious skill) → (Evade moderation) → (Harvest credentials)

Chain 2: Prompt injection to RCE

text
T-EXEC-001 → T-EXEC-004 → T-IMPACT-001(Inject prompt) → (Bypass exec approval) → (Execute commands)

Chain 3: Indirect injection via fetched content

text
T-EXEC-002 → T-EXFIL-001 → External exfiltration(Poison URL content) → (Agent fetches & follows instructions) → (Data sent to attacker)

6. Recommendations summary

6.1 Immediate (P0)

ID Recommendation Addresses
R-002 Implement skill execution sandboxing T-PERSIST-001, T-EXFIL-003
R-003 Add output validation for sensitive actions T-EXEC-001, T-EXEC-002

6.2 Short-term (P1)

ID Recommendation Addresses
R-004 Implement per-sender rate limiting T-IMPACT-002
R-005 Add token encryption at rest T-ACCESS-003
R-006 Improve exec approval UX and continue expanding command normalization T-EXEC-004
R-007 Implement URL allowlisting for web_fetch T-EXFIL-001

6.3 Medium-term (P2)

ID Recommendation Addresses
R-008 Implemented in core: graded identifier-authentication primitive and audit findings; remaining work is per-channel verified adoption and downstream strength mappers T-ACCESS-002
R-009 Implement config integrity verification T-PERSIST-003
R-010 Add update signing and version pinning T-PERSIST-002

7. Appendices

7.1 ATLAS technique mapping

ATLAS ID Technique name OpenClaw threats
AML.T0006 Active Scanning T-RECON-001, T-RECON-002
AML.T0009 Collection T-EXFIL-001, T-EXFIL-002, T-EXFIL-003
AML.T0010.001 Supply Chain: AI Software T-PERSIST-001, T-PERSIST-002
AML.T0010.002 Supply Chain: Data T-PERSIST-003
AML.T0031 Erode AI Model Integrity T-IMPACT-001, T-IMPACT-002, T-IMPACT-003
AML.T0040 AI Model Inference API Access T-ACCESS-001, T-ACCESS-002, T-ACCESS-003, T-DISC-001, T-DISC-002
AML.T0043 Craft Adversarial Data T-EXEC-004, T-EVADE-001, T-EVADE-002
AML.T0051.000 LLM Prompt Injection: Direct T-EXEC-001, T-EXEC-003
AML.T0051.001 LLM Prompt Injection: Indirect T-EXEC-002

7.2 Key security files

Path Purpose Risk level
src/infra/exec-approvals.ts Command approval logic Critical
src/gateway/auth.ts Gateway authentication Critical
src/infra/net/ssrf.ts SSRF protection Critical
src/security/external-content.ts Prompt injection mitigation Critical
src/agents/sandbox/tool-policy.ts Sandbox tool allow/deny policy Critical
src/routing/resolve-route.ts Session isolation / routing Medium

7.3 Glossary

Term Definition
ATLAS MITRE's Adversarial Threat Landscape for AI Systems
ClawHub OpenClaw's skill marketplace
Gateway OpenClaw's message routing and authentication layer
MCP Model Context Protocol - tool provider interface
Prompt injection Attack where malicious instructions are embedded in input
Skill Downloadable extension for OpenClaw agents
SSRF Server-Side Request Forgery

This threat model is a living document. Report security issues to [email protected] or see the Trust page.

Where each section moved

Every heading from the previous single-page version keeps its anchor here, so an existing link such as /security/THREAT-MODEL-ATLAS#t-exec-002-indirect-prompt-injection still resolves. Each entry points at the page that now holds the content.

Was this useful?
On this page

On this page