Threat model (MITRE ATLAS)

Version: 1.0-draft | Framework: MITRE ATLAS (Adversarial Threat Landscape for AI Systems) + data flow diagrams This threat model documents adversarial threats to the OpenClaw AI agent platform and ClawHub skill marketplace. It is a living document maintained by the OpenClaw community. See Contributing to the threat model for how to report new threats, propose attack chains, or suggest mitigations. Key ATLAS resources: ATLAS website | ATLAS data and contribution guide

1. Scope

Component	Included	Notes
OpenClaw agent runtime	Yes	Core agent execution, tool calls, sessions
Gateway	Yes	Authentication, routing, channel integration
Channel integrations	Yes	WhatsApp, Telegram, Discord, Signal, Slack, etc.
ClawHub marketplace	Yes	Skill publishing, moderation, distribution
MCP servers	Yes	External tool providers
User devices	Partial	Mobile apps, desktop clients

Out-of-scope reports and false-positive patterns (public internet exposure, prompt-injection-only chains without a boundary bypass, mutually untrusted operators sharing one gateway host, and others) are enumerated in SECURITY.md; that file is the current source of truth for vulnerability-report scope, not this page.

2. System architecture

2.1 Trust boundaries

┌─────────────────────────────────────────────────────────────────┐
│                    UNTRUSTED ZONE                                │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐              │
│  │  WhatsApp   │  │  Telegram   │  │   Discord   │  ...         │
│  └──────┬──────┘  └──────┬──────┘  └──────┬──────┘              │
│         │                │                │                      │
└─────────┼────────────────┼────────────────┼──────────────────────┘
          │                │                │
          ▼                ▼                ▼
┌─────────────────────────────────────────────────────────────────┐
│                 TRUST BOUNDARY 1: Channel Access                 │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │                      GATEWAY                              │   │
│  │  • Device pairing (1h DM pairing / 5m node pairing TTL)   │   │
│  │  • AllowFrom / allowlist validation                       │   │
│  │  • Token / password / Tailscale auth                      │   │
│  └──────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│                 TRUST BOUNDARY 2: Session Isolation              │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │                   AGENT SESSIONS                          │   │
│  │  • Session key = agent:channel:peer                       │   │
│  │  • Tool policies per agent                                │   │
│  │  • Transcript logging                                     │   │
│  └──────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│                 TRUST BOUNDARY 3: Tool Execution                 │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │                  EXECUTION SANDBOX                        │   │
│  │  • Docker sandbox (default) or host (exec approvals)      │   │
│  │  • Node remote execution                                  │   │
│  │  • SSRF protection (DNS pinning + IP blocking)            │   │
│  └──────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│                 TRUST BOUNDARY 4: External Content               │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │              FETCHED URLs / EMAILS / WEBHOOKS             │   │
│  │  • External content wrapping (random-boundary XML tags)   │   │
│  │  • Security notice injection                              │   │
│  └──────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│                 TRUST BOUNDARY 5: Supply Chain                   │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │                      CLAWHUB                              │   │
│  │  • Skill publishing (semver, SKILL.md required)           │   │
│  │  • Static pattern + AST-adjacent moderation scanning      │   │
│  │  • LLM-based agentic risk review + VirusTotal scanning    │   │
│  │  • GitHub account age verification (14 days)              │   │
│  └──────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

2.2 Data flows

Flow	Source	Destination	Data	Protection
F1	Channel	Gateway	User messages	TLS, AllowFrom
F2	Gateway	Agent	Routed messages	Session isolation
F3	Agent	Tools	Tool invocations	Policy enforcement
F4	Agent	External	`web_fetch` requests	SSRF blocking
F5	ClawHub	Agent	Skill code	Moderation, scanning
F6	Agent	Channel	Responses	Output filtering

3. Threat analysis by ATLAS tactic

The threat catalog is split by ATLAS tactic. Each page below holds the full attribute table for every threat in that tactic. The risk matrix in section 5 and the recommendations summary in section 6 index across all of them, and the ATLAS technique mapping in section 7.1 lists which threats implement each technique.

ATLAS tactic	Threats	Page
Reconnaissance (AML.TA0002)	T-RECON-001, T-RECON-002	Reconnaissance
Initial access (AML.TA0004)	T-ACCESS-001, T-ACCESS-002, T-ACCESS-003	Initial access
Execution (AML.TA0005)	T-EXEC-001, T-EXEC-002, T-EXEC-003, T-EXEC-004	Execution
Persistence (AML.TA0006)	T-PERSIST-001, T-PERSIST-002, T-PERSIST-003	Persistence
Defense evasion (AML.TA0007)	T-EVADE-001, T-EVADE-002	Defense evasion
Discovery (AML.TA0008)	T-DISC-001, T-DISC-002	Discovery
Collection and exfiltration (AML.TA0009, AML.TA0010)	T-EXFIL-001, T-EXFIL-002, T-EXFIL-003	Collection and exfiltration
Impact (AML.TA0011)	T-IMPACT-001, T-IMPACT-002, T-IMPACT-003	Impact

4. ClawHub supply chain analysis

4.1 Current security controls

Control	Implementation	Effectiveness
GitHub account age	`requireGitHubAccountAge()` (14-day minimum)	Medium - raises the bar for new attackers
Path sanitization	`sanitizePath()`	High - prevents path traversal
File type validation	`isTextFile()`	Medium - only text files scanned, but still exploitable
Size limits	50MB total bundle (`MAX_PUBLISH_TOTAL_BYTES`)	High - prevents resource exhaustion
Required SKILL.md	Mandatory readme on publish	Low security value - informational only
Static + AST-adjacent scanning	Pattern engine covering exec, exfiltration, credential-harvest, obfuscation, and more	Medium-High - covers many known abuse patterns, still pattern-based
LLM-based agentic risk review	Security-prompt-driven verdict on publish	Medium-High - catches behavior static patterns miss
VirusTotal scanning	Wired to skill and package-release publish/rescan flows, gated on operator API key	High when enabled - static engine detection
Moderation status	`moderationStatus` field	Medium - manual review possible

4.2 Moderation limitations

ClawHub’s static scanning inspects skill code content directly (not just slug/metadata/frontmatter), covering dangerous exec calls, dynamic code execution, credential harvesting, exfiltration patterns, obfuscated payloads, and more. Known gaps:

Pattern-based detection can still be bypassed by sufficiently novel obfuscation.
LLM-based review and VirusTotal scanning depend on operator-side API keys/config being enabled.
No runtime execution sandbox isolates a skill from the agent’s own privileges once installed.

4.3 Badges

Skills and packages carry moderator-assigned badges: highlighted, official, deprecated, redactionApproved (skills only). Community reporting (skillReports) and audit logging (auditLogs) back moderation workflows.

5. Risk matrix

5.1 Likelihood vs impact

Threat ID	Likelihood	Impact	Risk level	Priority
T-EXEC-001	High	Critical	Critical	P0
T-PERSIST-001	High	Critical	Critical	P0
T-EXFIL-003	Medium	Critical	Critical	P0
T-IMPACT-001	Medium	Critical	High	P1
T-EXEC-002	High	High	High	P1
T-EXEC-004	Medium	High	High	P1
T-ACCESS-003	Medium	High	High	P1
T-EXFIL-001	Medium	High	High	P1
T-IMPACT-002	High	Medium	High	P1
T-EVADE-001	High	Medium	Medium	P2
T-ACCESS-001	Low	High	Medium	P2
T-ACCESS-002	Low	High	Medium	P2
T-PERSIST-002	Low	High	Medium	P2

5.2 Critical path attack chains

Chain 1: Skill-based data theft

T-PERSIST-001 → T-EVADE-001 → T-EXFIL-003
(Publish malicious skill) → (Evade moderation) → (Harvest credentials)

Chain 2: Prompt injection to RCE

T-EXEC-001 → T-EXEC-004 → T-IMPACT-001
(Inject prompt) → (Bypass exec approval) → (Execute commands)

Chain 3: Indirect injection via fetched content

T-EXEC-002 → T-EXFIL-001 → External exfiltration
(Poison URL content) → (Agent fetches & follows instructions) → (Data sent to attacker)

6. Recommendations summary

6.1 Immediate (P0)

ID	Recommendation	Addresses
R-002	Implement skill execution sandboxing	T-PERSIST-001, T-EXFIL-003
R-003	Add output validation for sensitive actions	T-EXEC-001, T-EXEC-002

6.2 Short-term (P1)

ID	Recommendation	Addresses
R-004	Implement per-sender rate limiting	T-IMPACT-002
R-005	Add token encryption at rest	T-ACCESS-003
R-006	Improve exec approval UX and continue expanding command normalization	T-EXEC-004
R-007	Implement URL allowlisting for `web_fetch`	T-EXFIL-001

6.3 Medium-term (P2)

ID	Recommendation	Addresses
R-008	Implemented in core: graded identifier-authentication primitive and audit findings; remaining work is per-channel `verified` adoption and downstream strength mappers	T-ACCESS-002
R-009	Implement config integrity verification	T-PERSIST-003
R-010	Add update signing and version pinning	T-PERSIST-002

7. Appendices

7.1 ATLAS technique mapping

ATLAS ID	Technique name	OpenClaw threats
AML.T0006	Active Scanning	T-RECON-001, T-RECON-002
AML.T0009	Collection	T-EXFIL-001, T-EXFIL-002, T-EXFIL-003
AML.T0010.001	Supply Chain: AI Software	T-PERSIST-001, T-PERSIST-002
AML.T0010.002	Supply Chain: Data	T-PERSIST-003
AML.T0031	Erode AI Model Integrity	T-IMPACT-001, T-IMPACT-002, T-IMPACT-003
AML.T0040	AI Model Inference API Access	T-ACCESS-001, T-ACCESS-002, T-ACCESS-003, T-DISC-001, T-DISC-002
AML.T0043	Craft Adversarial Data	T-EXEC-004, T-EVADE-001, T-EVADE-002
AML.T0051.000	LLM Prompt Injection: Direct	T-EXEC-001, T-EXEC-003
AML.T0051.001	LLM Prompt Injection: Indirect	T-EXEC-002

7.2 Key security files

Path	Purpose	Risk level
`src/infra/exec-approvals.ts`	Command approval logic	Critical
`src/gateway/auth.ts`	Gateway authentication	Critical
`src/infra/net/ssrf.ts`	SSRF protection	Critical
`src/security/external-content.ts`	Prompt injection mitigation	Critical
`src/agents/sandbox/tool-policy.ts`	Sandbox tool allow/deny policy	Critical
`src/routing/resolve-route.ts`	Session isolation / routing	Medium

7.3 Glossary

Term	Definition
ATLAS	MITRE’s Adversarial Threat Landscape for AI Systems
ClawHub	OpenClaw’s skill marketplace
Gateway	OpenClaw’s message routing and authentication layer
MCP	Model Context Protocol - tool provider interface
Prompt injection	Attack where malicious instructions are embedded in input
Skill	Downloadable extension for OpenClaw agents
SSRF	Server-Side Request Forgery

This threat model is a living document. Report security issues to security@openclaw.ai or see the Trust page.

Where each section moved

Every heading from the previous single-page version keeps its anchor here, so an existing link such as /security/THREAT-MODEL-ATLAS#t-exec-002-indirect-prompt-injection still resolves. Each entry points at the page that now holds the content.

Gateway

Remote access

Security

Nodes and media

Web interfaces

Threat model (MITRE ATLAS)

1. Scope

2. System architecture

2.1 Trust boundaries

2.2 Data flows

3. Threat analysis by ATLAS tactic

4. ClawHub supply chain analysis

4.1 Current security controls

4.2 Moderation limitations

4.3 Badges

5. Risk matrix

5.1 Likelihood vs impact

5.2 Critical path attack chains

6. Recommendations summary

6.1 Immediate (P0)

6.2 Short-term (P1)

6.3 Medium-term (P2)

7. Appendices

7.1 ATLAS technique mapping

7.2 Key security files

7.3 Glossary

Where each section moved

​1. Scope

​2. System architecture

​2.1 Trust boundaries

​2.2 Data flows

​3. Threat analysis by ATLAS tactic

​4. ClawHub supply chain analysis

​4.1 Current security controls

​4.2 Moderation limitations

​4.3 Badges

​5. Risk matrix

​5.1 Likelihood vs impact

​5.2 Critical path attack chains

​6. Recommendations summary

​6.1 Immediate (P0)

​6.2 Short-term (P1)

​6.3 Medium-term (P2)

​7. Appendices

​7.1 ATLAS technique mapping

​7.2 Key security files

​7.3 Glossary

​Where each section moved

​Related

1. Scope

2. System architecture

2.1 Trust boundaries

2.2 Data flows

3. Threat analysis by ATLAS tactic

4. ClawHub supply chain analysis

4.1 Current security controls

4.2 Moderation limitations

4.3 Badges

5. Risk matrix

5.1 Likelihood vs impact

5.2 Critical path attack chains

6. Recommendations summary

6.1 Immediate (P0)

6.2 Short-term (P1)

6.3 Medium-term (P2)

7. Appendices

7.1 ATLAS technique mapping

7.2 Key security files

7.3 Glossary

Where each section moved

Related