@waratahlabs/canopy 0.5.0

package/demo/data/openclaw-demo.tc.json

@@ -0,0 +1,397 @@
+{
+  "schema": 1,
+  "applicationInfo": {
+    "name": "OpenClaw Personal AI Assistant",
+    "description": "AIVSS V4 + ATLAS threat model for 1 agent(s) and 2 handoff(s)."
+  },
+  "metadata": [
+    {
+      "key": "canopy-version",
+      "value": "0.1.0"
+    },
+    {
+      "key": "aivss-version",
+      "value": "0.8"
+    },
+    {
+      "key": "atlas-version",
+      "value": "5.6.0"
+    },
+    {
+      "key": "acsc-version",
+      "value": "2026-05"
+    },
+    {
+      "key": "demo",
+      "value": "true"
+    },
+    {
+      "key": "generated-at",
+      "value": "2026-05-30T00:00:00.000Z"
+    }
+  ],
+  "threats": [
+    {
+      "id": "t-001",
+      "numericId": 1,
+      "threatSource": "External attacker with channel access",
+      "prerequisites": "Attacker can send messages to an enabled OpenClaw channel (iMessage, Telegram, Slack)",
+      "threatAction": "Inject a crafted prompt via an inbound message that overrides the assistant's system instructions, causing it to exfiltrate data, execute unintended tool calls, or pivot to other channels",
+      "threatImpact": "Unauthorised data access, credential exfiltration, lateral movement to connected services",
+      "impactedGoal": [
+        "Confidentiality",
+        "Integrity"
+      ],
+      "impactedAssets": [
+        "User messages",
+        "Skill API keys",
+        "MCP server credentials"
+      ],
+      "statement": "An attacker with access to any of OpenClaw's 20+ inbound channels can inject adversarial prompts that cause the assistant to execute unintended actions, exfiltrate data through outbound channels, or abuse skills with stored credentials \u2014 because the assistant lacks per-channel trust boundaries and message authenticity verification.",
+      "status": "identified",
+      "metadata": [
+        {
+          "key": "aivss-metric",
+          "value": "MR"
+        },
+        {
+          "key": "aivss-subCategory",
+          "value": "Prompt Injection Resistance"
+        },
+        {
+          "key": "aivss-severity",
+          "value": "High"
+        },
+        {
+          "key": "atlas-techniqueId",
+          "value": "AML.T0051"
+        },
+        {
+          "key": "atlas-techniqueName",
+          "value": "LLM Prompt Injection"
+        },
+        {
+          "key": "atlas-tactic",
+          "value": "Initial Access"
+        },
+        {
+          "key": "acsc-riskFamily",
+          "value": "design-and-configuration"
+        },
+        {
+          "key": "acsc-riskId",
+          "value": "acsc-dc-002"
+        },
+        {
+          "key": "deploymentContext",
+          "value": "General"
+        },
+        {
+          "key": "priority",
+          "value": "high"
+        }
+      ]
+    },
+    {
+      "id": "t-002",
+      "numericId": 2,
+      "threatSource": "Compromised skill package or malicious ClawHub skill",
+      "prerequisites": "User installs a skill from an unverified source; skill has no SKILL.md (UNDECLARED_CAPABILITY_RISK)",
+      "threatAction": "Malicious skill intercepts tool calls, exfiltrates conversation history, or establishes persistence via cron hooks",
+      "threatImpact": "Persistent access to all conversations and credentials; potential lateral movement via messaging channels",
+      "impactedGoal": [
+        "Confidentiality",
+        "Availability"
+      ],
+      "impactedAssets": [
+        "Conversation history",
+        "Stored secrets",
+        "Cron scheduler"
+      ],
+      "statement": "Skills installed without a SKILL.md (undeclared capabilities) cannot be assessed by Canopy or audited by the user \u2014 an attacker publishing a skill to ClawHub can establish persistent access to conversations and credentials because OpenClaw has no supply-chain verification gate for skill installation.",
+      "status": "identified",
+      "metadata": [
+        {
+          "key": "aivss-metric",
+          "value": "CS"
+        },
+        {
+          "key": "aivss-subCategory",
+          "value": "Third-Party Component Risk"
+        },
+        {
+          "key": "aivss-severity",
+          "value": "High"
+        },
+        {
+          "key": "atlas-techniqueId",
+          "value": "AML.T0010"
+        },
+        {
+          "key": "atlas-techniqueName",
+          "value": "ML Supply Chain Compromise"
+        },
+        {
+          "key": "atlas-tactic",
+          "value": "Persistence"
+        },
+        {
+          "key": "acsc-riskFamily",
+          "value": "structural"
+        },
+        {
+          "key": "acsc-riskId",
+          "value": "acsc-s-001"
+        },
+        {
+          "key": "deploymentContext",
+          "value": "General"
+        },
+        {
+          "key": "priority",
+          "value": "high"
+        }
+      ]
+    },
+    {
+      "id": "t-003",
+      "numericId": 3,
+      "threatSource": "Insider or compromised device",
+      "prerequisites": "Attacker has local access to the device running OpenClaw",
+      "threatAction": "Read plaintext API keys from openclaw.json or skill config; use credentials to access external services directly",
+      "threatImpact": "Credential theft enabling persistent access to all connected external services",
+      "impactedGoal": [
+        "Confidentiality"
+      ],
+      "impactedAssets": [
+        "Skill API keys",
+        "Channel tokens",
+        "MCP server credentials"
+      ],
+      "statement": "OpenClaw stores skill API keys and channel tokens in openclaw.json on the local filesystem \u2014 an attacker with device access or a malicious skill with file-read capability can harvest all credentials, gaining direct access to every external service the assistant is authorised to use.",
+      "status": "identified",
+      "metadata": [
+        {
+          "key": "aivss-metric",
+          "value": "DC"
+        },
+        {
+          "key": "aivss-subCategory",
+          "value": "Credential Storage Security"
+        },
+        {
+          "key": "aivss-severity",
+          "value": "Medium"
+        },
+        {
+          "key": "atlas-techniqueId",
+          "value": "AML.T0044"
+        },
+        {
+          "key": "atlas-techniqueName",
+          "value": "Full ML Model Access"
+        },
+        {
+          "key": "atlas-tactic",
+          "value": "Credential Access"
+        },
+        {
+          "key": "acsc-riskFamily",
+          "value": "privilege"
+        },
+        {
+          "key": "acsc-riskId",
+          "value": "acsc-p-001"
+        },
+        {
+          "key": "deploymentContext",
+          "value": "General"
+        },
+        {
+          "key": "priority",
+          "value": "medium"
+        }
+      ]
+    },
+    {
+      "id": "t-004",
+      "numericId": 4,
+      "threatSource": "Malicious message payload via any connected channel",
+      "prerequisites": "Cron is enabled (cron.enabled=true); attacker can craft a cron-triggering instruction",
+      "threatAction": "Establish a persistent scheduled job that periodically exfiltrates data or monitors conversation history without user awareness",
+      "threatImpact": "Persistent, recurring data exfiltration; long-dwell presence undetected by users",
+      "impactedGoal": [
+        "Confidentiality",
+        "Integrity"
+      ],
+      "impactedAssets": [
+        "Conversation history",
+        "User data",
+        "External service access"
+      ],
+      "statement": "With cron enabled, an attacker who achieves a single successful prompt injection can schedule a recurring job that executes autonomously \u2014 establishing persistent access that survives conversation resets and operates silently between user interactions.",
+      "status": "identified",
+      "metadata": [
+        {
+          "key": "aivss-metric",
+          "value": "AA"
+        },
+        {
+          "key": "aivss-subCategory",
+          "value": "Autonomous Execution Control"
+        },
+        {
+          "key": "aivss-severity",
+          "value": "High"
+        },
+        {
+          "key": "atlas-techniqueId",
+          "value": "AML.T0080"
+        },
+        {
+          "key": "atlas-techniqueName",
+          "value": "Establish Persistence via Agent"
+        },
+        {
+          "key": "atlas-tactic",
+          "value": "Persistence"
+        },
+        {
+          "key": "acsc-riskFamily",
+          "value": "behaviour"
+        },
+        {
+          "key": "acsc-riskId",
+          "value": "acsc-b-003"
+        },
+        {
+          "key": "deploymentContext",
+          "value": "General"
+        },
+        {
+          "key": "priority",
+          "value": "high"
+        },
+        {
+          "key": "deploymentBlocker",
+          "value": "false"
+        }
+      ]
+    },
+    {
+      "id": "t-005",
+      "numericId": 5,
+      "threatSource": "Compromised personal device on corporate network",
+      "prerequisites": "OpenClaw runs on a personal device with both personal messaging and corporate Slack/Teams enabled; device is network-adjacent to corporate infrastructure",
+      "threatAction": "Use OpenClaw's Slack or Teams channel access to send messages as the user, extract corporate data, or enumerate internal systems \u2014 pivoting from a personal device to the corporate network",
+      "threatImpact": "Corporate data exfiltration; lateral movement to internal systems via trusted identity",
+      "impactedGoal": [
+        "Confidentiality",
+        "Integrity"
+      ],
+      "impactedAssets": [
+        "Corporate Slack workspace",
+        "Microsoft Teams",
+        "User's corporate identity"
+      ],
+      "statement": "OpenClaw's multi-channel architecture \u2014 connecting personal messaging (iMessage, WhatsApp) and corporate channels (Slack, Teams) in a single assistant \u2014 creates a personal-to-corporate pivot path: an attacker compromising the personal device gains the assistant's full channel access, including corporate channels the device owner is trusted on.",
+      "status": "identified",
+      "metadata": [
+        {
+          "key": "aivss-metric",
+          "value": "EI"
+        },
+        {
+          "key": "aivss-subCategory",
+          "value": "Cross-Context Data Leakage"
+        },
+        {
+          "key": "aivss-severity",
+          "value": "High"
+        },
+        {
+          "key": "atlas-techniqueId",
+          "value": "AML.T0043"
+        },
+        {
+          "key": "atlas-techniqueName",
+          "value": "Craft Adversarial Data"
+        },
+        {
+          "key": "atlas-tactic",
+          "value": "Exfiltration"
+        },
+        {
+          "key": "acsc-riskFamily",
+          "value": "structural"
+        },
+        {
+          "key": "acsc-riskId",
+          "value": "acsc-s-002"
+        },
+        {
+          "key": "deploymentContext",
+          "value": "General"
+        },
+        {
+          "key": "priority",
+          "value": "high"
+        }
+      ]
+    }
+  ],
+  "mitigations": [
+    {
+      "id": "m-001",
+      "numericId": 1,
+      "content": "Implement per-channel trust tiers: treat messages from unknown senders as untrusted; require explicit user confirmation before executing tool calls from untrusted channel messages."
+    },
+    {
+      "id": "m-002",
+      "numericId": 2,
+      "content": "Require SKILL.md for all skill installations; reject or sandbox skills without capability declarations. Implement skill signing or hash verification for ClawHub-sourced skills."
+    },
+    {
+      "id": "m-003",
+      "numericId": 3,
+      "content": "Store skill API keys in the OS keychain (macOS Keychain / libsecret) rather than openclaw.json plaintext. Use OPENCLAW_SECRET_* env vars for CI/server deployments."
+    },
+    {
+      "id": "m-004",
+      "numericId": 4,
+      "content": "Gate cron job creation behind explicit user approval; show all active cron jobs in the Canvas UI; require re-confirmation for cron jobs that run > 7 days after creation."
+    },
+    {
+      "id": "m-005",
+      "numericId": 5,
+      "content": "Separate corporate and personal channel profiles; require explicit context-switch confirmation before executing tool calls that cross the personal/corporate boundary."
+    }
+  ],
+  "mitigationLinks": [
+    {
+      "mitigationId": "m-001",
+      "linkedId": "t-001",
+      "type": "Threat"
+    },
+    {
+      "mitigationId": "m-002",
+      "linkedId": "t-002",
+      "type": "Threat"
+    },
+    {
+      "mitigationId": "m-003",
+      "linkedId": "t-003",
+      "type": "Threat"
+    },
+    {
+      "mitigationId": "m-004",
+      "linkedId": "t-004",
+      "type": "Threat"
+    },
+    {
+      "mitigationId": "m-005",
+      "linkedId": "t-005",
+      "type": "Threat"
+    }
+  ]
+}