@waratahlabs/canopy 0.5.0 → 0.6.0

package/demo/data/openclaw-demo.tc.json

@@ -5,30 +5,12 @@
     "description": "AIVSS V4 + ATLAS threat model for 1 agent(s) and 2 handoff(s)."
   },
   "metadata": [
-    {
-      "key": "canopy-version",
-      "value": "0.1.0"
-    },
-    {
-      "key": "aivss-version",
-      "value": "0.8"
-    },
-    {
-      "key": "atlas-version",
-      "value": "5.6.0"
-    },
-    {
-      "key": "acsc-version",
-      "value": "2026-05"
-    },
-    {
-      "key": "demo",
-      "value": "true"
-    },
-    {
-      "key": "generated-at",
-      "value": "2026-05-30T00:00:00.000Z"
-    }
+    { "key": "canopy-version", "value": "0.1.0" },
+    { "key": "aivss-version", "value": "0.8" },
+    { "key": "atlas-version", "value": "5.6.0" },
+    { "key": "acsc-version", "value": "2026-05" },
+    { "key": "demo", "value": "true" },
+    { "key": "generated-at", "value": "2026-05-30T00:00:00.000Z" }
   ],
   "threats": [
     {
@@ -38,58 +20,21 @@
       "prerequisites": "Attacker can send messages to an enabled OpenClaw channel (iMessage, Telegram, Slack)",
       "threatAction": "Inject a crafted prompt via an inbound message that overrides the assistant's system instructions, causing it to exfiltrate data, execute unintended tool calls, or pivot to other channels",
       "threatImpact": "Unauthorised data access, credential exfiltration, lateral movement to connected services",
-      "impactedGoal": [
-        "Confidentiality",
-        "Integrity"
-      ],
-      "impactedAssets": [
-        "User messages",
-        "Skill API keys",
-        "MCP server credentials"
-      ],
-      "statement": "An attacker with access to any of OpenClaw's 20+ inbound channels can inject adversarial prompts that cause the assistant to execute unintended actions, exfiltrate data through outbound channels, or abuse skills with stored credentials \u2014 because the assistant lacks per-channel trust boundaries and message authenticity verification.",
+      "impactedGoal": ["Confidentiality", "Integrity"],
+      "impactedAssets": ["User messages", "Skill API keys", "MCP server credentials"],
+      "statement": "An attacker with access to any of OpenClaw's 20+ inbound channels can inject adversarial prompts that cause the assistant to execute unintended actions, exfiltrate data through outbound channels, or abuse skills with stored credentials — because the assistant lacks per-channel trust boundaries and message authenticity verification.",
       "status": "identified",
       "metadata": [
-        {
-          "key": "aivss-metric",
-          "value": "MR"
-        },
-        {
-          "key": "aivss-subCategory",
-          "value": "Prompt Injection Resistance"
-        },
-        {
-          "key": "aivss-severity",
-          "value": "High"
-        },
-        {
-          "key": "atlas-techniqueId",
-          "value": "AML.T0051"
-        },
-        {
-          "key": "atlas-techniqueName",
-          "value": "LLM Prompt Injection"
-        },
-        {
-          "key": "atlas-tactic",
-          "value": "Initial Access"
-        },
-        {
-          "key": "acsc-riskFamily",
-          "value": "design-and-configuration"
-        },
-        {
-          "key": "acsc-riskId",
-          "value": "acsc-dc-002"
-        },
-        {
-          "key": "deploymentContext",
-          "value": "General"
-        },
-        {
-          "key": "priority",
-          "value": "high"
-        }
+        { "key": "aivss-metric", "value": "MR" },
+        { "key": "aivss-subCategory", "value": "Prompt Injection Resistance" },
+        { "key": "aivss-severity", "value": "High" },
+        { "key": "atlas-techniqueId", "value": "AML.T0051" },
+        { "key": "atlas-techniqueName", "value": "LLM Prompt Injection" },
+        { "key": "atlas-tactic", "value": "Initial Access" },
+        { "key": "acsc-riskFamily", "value": "design-and-configuration" },
+        { "key": "acsc-riskId", "value": "acsc-dc-002" },
+        { "key": "deploymentContext", "value": "General" },
+        { "key": "priority", "value": "high" }
       ]
     },
     {
@@ -99,58 +44,23 @@
       "prerequisites": "User installs a skill from an unverified source; skill has no SKILL.md (UNDECLARED_CAPABILITY_RISK)",
       "threatAction": "Malicious skill intercepts tool calls, exfiltrates conversation history, or establishes persistence via cron hooks",
       "threatImpact": "Persistent access to all conversations and credentials; potential lateral movement via messaging channels",
-      "impactedGoal": [
-        "Confidentiality",
-        "Availability"
-      ],
-      "impactedAssets": [
-        "Conversation history",
-        "Stored secrets",
-        "Cron scheduler"
-      ],
-      "statement": "Skills installed without a SKILL.md (undeclared capabilities) cannot be assessed by Canopy or audited by the user \u2014 an attacker publishing a skill to ClawHub can establish persistent access to conversations and credentials because OpenClaw has no supply-chain verification gate for skill installation.",
+      "impactedGoal": ["Confidentiality", "Availability"],
+      "impactedAssets": ["Conversation history", "Stored secrets", "Cron scheduler"],
+      "statement": "Skills installed without a SKILL.md (undeclared capabilities) cannot be assessed by Canopy or audited by the user — an attacker publishing a skill to ClawHub can establish persistent access to conversations and credentials because OpenClaw has no supply-chain verification gate for skill installation.",
       "status": "identified",
       "metadata": [
-        {
-          "key": "aivss-metric",
-          "value": "CS"
-        },
-        {
-          "key": "aivss-subCategory",
-          "value": "Third-Party Component Risk"
-        },
-        {
-          "key": "aivss-severity",
-          "value": "High"
-        },
-        {
-          "key": "atlas-techniqueId",
-          "value": "AML.T0010"
-        },
-        {
-          "key": "atlas-techniqueName",
-          "value": "ML Supply Chain Compromise"
-        },
-        {
-          "key": "atlas-tactic",
-          "value": "Persistence"
-        },
-        {
-          "key": "acsc-riskFamily",
-          "value": "structural"
-        },
-        {
-          "key": "acsc-riskId",
-          "value": "acsc-s-001"
-        },
-        {
-          "key": "deploymentContext",
-          "value": "General"
-        },
-        {
-          "key": "priority",
-          "value": "high"
-        }
+        { "key": "aivss-metric", "value": "CS" },
+        { "key": "aivss-subCategory", "value": "Third-Party Component Risk" },
+        { "key": "aivss-severity", "value": "High" },
+        { "key": "atlas-techniqueId", "value": "AML.T0010" },
+        { "key": "atlas-techniqueName", "value": "ML Supply Chain Compromise" },
+        { "key": "atlas-tactic", "value": "Persistence" },
+        { "key": "acsc-riskFamily", "value": "structural" },
+        { "key": "acsc-riskId", "value": "acsc-s-001" },
+        { "key": "jarkas-layer", "value": "L2 Application" },
+        { "key": "jarkas-exploitType", "value": "Supply chain injection" },
+        { "key": "deploymentContext", "value": "General" },
+        { "key": "priority", "value": "high" }
       ]
     },
     {
@@ -160,57 +70,21 @@
       "prerequisites": "Attacker has local access to the device running OpenClaw",
       "threatAction": "Read plaintext API keys from openclaw.json or skill config; use credentials to access external services directly",
       "threatImpact": "Credential theft enabling persistent access to all connected external services",
-      "impactedGoal": [
-        "Confidentiality"
-      ],
-      "impactedAssets": [
-        "Skill API keys",
-        "Channel tokens",
-        "MCP server credentials"
-      ],
-      "statement": "OpenClaw stores skill API keys and channel tokens in openclaw.json on the local filesystem \u2014 an attacker with device access or a malicious skill with file-read capability can harvest all credentials, gaining direct access to every external service the assistant is authorised to use.",
+      "impactedGoal": ["Confidentiality"],
+      "impactedAssets": ["Skill API keys", "Channel tokens", "MCP server credentials"],
+      "statement": "OpenClaw stores skill API keys and channel tokens in openclaw.json on the local filesystem — an attacker with device access or a malicious skill with file-read capability can harvest all credentials, gaining direct access to every external service the assistant is authorised to use.",
       "status": "identified",
       "metadata": [
-        {
-          "key": "aivss-metric",
-          "value": "DC"
-        },
-        {
-          "key": "aivss-subCategory",
-          "value": "Credential Storage Security"
-        },
-        {
-          "key": "aivss-severity",
-          "value": "Medium"
-        },
-        {
-          "key": "atlas-techniqueId",
-          "value": "AML.T0044"
-        },
-        {
-          "key": "atlas-techniqueName",
-          "value": "Full ML Model Access"
-        },
-        {
-          "key": "atlas-tactic",
-          "value": "Credential Access"
-        },
-        {
-          "key": "acsc-riskFamily",
-          "value": "privilege"
-        },
-        {
-          "key": "acsc-riskId",
-          "value": "acsc-p-001"
-        },
-        {
-          "key": "deploymentContext",
-          "value": "General"
-        },
-        {
-          "key": "priority",
-          "value": "medium"
-        }
+        { "key": "aivss-metric", "value": "DC" },
+        { "key": "aivss-subCategory", "value": "Credential Storage Security" },
+        { "key": "aivss-severity", "value": "Medium" },
+        { "key": "atlas-techniqueId", "value": "AML.T0044" },
+        { "key": "atlas-techniqueName", "value": "Full ML Model Access" },
+        { "key": "atlas-tactic", "value": "Credential Access" },
+        { "key": "acsc-riskFamily", "value": "privilege" },
+        { "key": "acsc-riskId", "value": "acsc-p-001" },
+        { "key": "deploymentContext", "value": "General" },
+        { "key": "priority", "value": "medium" }
       ]
     },
     {
@@ -220,62 +94,22 @@
       "prerequisites": "Cron is enabled (cron.enabled=true); attacker can craft a cron-triggering instruction",
       "threatAction": "Establish a persistent scheduled job that periodically exfiltrates data or monitors conversation history without user awareness",
       "threatImpact": "Persistent, recurring data exfiltration; long-dwell presence undetected by users",
-      "impactedGoal": [
-        "Confidentiality",
-        "Integrity"
-      ],
-      "impactedAssets": [
-        "Conversation history",
-        "User data",
-        "External service access"
-      ],
-      "statement": "With cron enabled, an attacker who achieves a single successful prompt injection can schedule a recurring job that executes autonomously \u2014 establishing persistent access that survives conversation resets and operates silently between user interactions.",
+      "impactedGoal": ["Confidentiality", "Integrity"],
+      "impactedAssets": ["Conversation history", "User data", "External service access"],
+      "statement": "With cron enabled, an attacker who achieves a single successful prompt injection can schedule a recurring job that executes autonomously — establishing persistent access that survives conversation resets and operates silently between user interactions.",
       "status": "identified",
       "metadata": [
-        {
-          "key": "aivss-metric",
-          "value": "AA"
-        },
-        {
-          "key": "aivss-subCategory",
-          "value": "Autonomous Execution Control"
-        },
-        {
-          "key": "aivss-severity",
-          "value": "High"
-        },
-        {
-          "key": "atlas-techniqueId",
-          "value": "AML.T0080"
-        },
-        {
-          "key": "atlas-techniqueName",
-          "value": "Establish Persistence via Agent"
-        },
-        {
-          "key": "atlas-tactic",
-          "value": "Persistence"
-        },
-        {
-          "key": "acsc-riskFamily",
-          "value": "behaviour"
-        },
-        {
-          "key": "acsc-riskId",
-          "value": "acsc-b-003"
-        },
-        {
-          "key": "deploymentContext",
-          "value": "General"
-        },
-        {
-          "key": "priority",
-          "value": "high"
-        },
-        {
-          "key": "deploymentBlocker",
-          "value": "false"
-        }
+        { "key": "aivss-metric", "value": "AA" },
+        { "key": "aivss-subCategory", "value": "Autonomous Execution Control" },
+        { "key": "aivss-severity", "value": "High" },
+        { "key": "atlas-techniqueId", "value": "AML.T0080" },
+        { "key": "atlas-techniqueName", "value": "Establish Persistence via Agent" },
+        { "key": "atlas-tactic", "value": "Persistence" },
+        { "key": "acsc-riskFamily", "value": "behaviour" },
+        { "key": "acsc-riskId", "value": "acsc-b-003" },
+        { "key": "deploymentContext", "value": "General" },
+        { "key": "priority", "value": "high" },
+        { "key": "deploymentBlocker", "value": "false" }
       ]
     },
     {
@@ -283,60 +117,23 @@
       "numericId": 5,
       "threatSource": "Compromised personal device on corporate network",
       "prerequisites": "OpenClaw runs on a personal device with both personal messaging and corporate Slack/Teams enabled; device is network-adjacent to corporate infrastructure",
-      "threatAction": "Use OpenClaw's Slack or Teams channel access to send messages as the user, extract corporate data, or enumerate internal systems \u2014 pivoting from a personal device to the corporate network",
+      "threatAction": "Use OpenClaw's Slack or Teams channel access to send messages as the user, extract corporate data, or enumerate internal systems — pivoting from a personal device to the corporate network",
       "threatImpact": "Corporate data exfiltration; lateral movement to internal systems via trusted identity",
-      "impactedGoal": [
-        "Confidentiality",
-        "Integrity"
-      ],
-      "impactedAssets": [
-        "Corporate Slack workspace",
-        "Microsoft Teams",
-        "User's corporate identity"
-      ],
-      "statement": "OpenClaw's multi-channel architecture \u2014 connecting personal messaging (iMessage, WhatsApp) and corporate channels (Slack, Teams) in a single assistant \u2014 creates a personal-to-corporate pivot path: an attacker compromising the personal device gains the assistant's full channel access, including corporate channels the device owner is trusted on.",
+      "impactedGoal": ["Confidentiality", "Integrity"],
+      "impactedAssets": ["Corporate Slack workspace", "Microsoft Teams", "User's corporate identity"],
+      "statement": "OpenClaw's multi-channel architecture — connecting personal messaging (iMessage, WhatsApp) and corporate channels (Slack, Teams) in a single assistant — creates a personal-to-corporate pivot path: an attacker compromising the personal device gains the assistant's full channel access, including corporate channels the device owner is trusted on.",
       "status": "identified",
       "metadata": [
-        {
-          "key": "aivss-metric",
-          "value": "EI"
-        },
-        {
-          "key": "aivss-subCategory",
-          "value": "Cross-Context Data Leakage"
-        },
-        {
-          "key": "aivss-severity",
-          "value": "High"
-        },
-        {
-          "key": "atlas-techniqueId",
-          "value": "AML.T0043"
-        },
-        {
-          "key": "atlas-techniqueName",
-          "value": "Craft Adversarial Data"
-        },
-        {
-          "key": "atlas-tactic",
-          "value": "Exfiltration"
-        },
-        {
-          "key": "acsc-riskFamily",
-          "value": "structural"
-        },
-        {
-          "key": "acsc-riskId",
-          "value": "acsc-s-002"
-        },
-        {
-          "key": "deploymentContext",
-          "value": "General"
-        },
-        {
-          "key": "priority",
-          "value": "high"
-        }
+        { "key": "aivss-metric", "value": "EI" },
+        { "key": "aivss-subCategory", "value": "Cross-Context Data Leakage" },
+        { "key": "aivss-severity", "value": "High" },
+        { "key": "atlas-techniqueId", "value": "AML.T0043" },
+        { "key": "atlas-techniqueName", "value": "Craft Adversarial Data" },
+        { "key": "atlas-tactic", "value": "Exfiltration" },
+        { "key": "acsc-riskFamily", "value": "structural" },
+        { "key": "acsc-riskId", "value": "acsc-s-002" },
+        { "key": "deploymentContext", "value": "General" },
+        { "key": "priority", "value": "high" }
       ]
     }
   ],
@@ -368,30 +165,10 @@
     }
   ],
   "mitigationLinks": [
-    {
-      "mitigationId": "m-001",
-      "linkedId": "t-001",
-      "type": "Threat"
-    },
-    {
-      "mitigationId": "m-002",
-      "linkedId": "t-002",
-      "type": "Threat"
-    },
-    {
-      "mitigationId": "m-003",
-      "linkedId": "t-003",
-      "type": "Threat"
-    },
-    {
-      "mitigationId": "m-004",
-      "linkedId": "t-004",
-      "type": "Threat"
-    },
-    {
-      "mitigationId": "m-005",
-      "linkedId": "t-005",
-      "type": "Threat"
-    }
+    { "mitigationId": "m-001", "linkedId": "t-001", "type": "Threat" },
+    { "mitigationId": "m-002", "linkedId": "t-002", "type": "Threat" },
+    { "mitigationId": "m-003", "linkedId": "t-003", "type": "Threat" },
+    { "mitigationId": "m-004", "linkedId": "t-004", "type": "Threat" },
+    { "mitigationId": "m-005", "linkedId": "t-005", "type": "Threat" }
   ]
 }