@waratahlabs/canopy 0.5.0

package/demo/data/openclaw-nemoclaw-demo.tc.json

@@ -0,0 +1,475 @@
+{
+  "schema": 1,
+  "applicationInfo": {
+    "name": "OpenClaw + NeMo Claw (Sandboxed)",
+    "description": "AIVSS V4 + ATLAS threat model for 1 agent(s) with NeMo Claw kernel-level isolation applied."
+  },
+  "metadata": [
+    {
+      "key": "canopy-version",
+      "value": "0.1.0"
+    },
+    {
+      "key": "aivss-version",
+      "value": "0.8"
+    },
+    {
+      "key": "atlas-version",
+      "value": "5.6.0"
+    },
+    {
+      "key": "acsc-version",
+      "value": "2026-05"
+    },
+    {
+      "key": "nemoclaw-version",
+      "value": "alpha-2026"
+    },
+    {
+      "key": "demo",
+      "value": "true"
+    },
+    {
+      "key": "generated-at",
+      "value": "2026-05-30T00:00:00.000Z"
+    },
+    {
+      "key": "security-wrapper",
+      "value": "NeMo Claw"
+    },
+    {
+      "key": "isolation-layers",
+      "value": "Network + Filesystem + Process + Inference"
+    }
+  ],
+  "threats": [
+    {
+      "id": "t-001",
+      "numericId": 1,
+      "threatSource": "External attacker with channel access",
+      "prerequisites": "Attacker can send messages to an enabled OpenClaw channel (iMessage, Telegram, Slack)",
+      "threatAction": "Inject a crafted prompt via an inbound message that causes the assistant to execute unintended tool calls within the sandbox boundary",
+      "threatImpact": "Unintended tool execution within /sandbox; exfiltration limited to allowlisted endpoints; host filesystem and credentials inaccessible",
+      "impactedGoal": [
+        "Integrity"
+      ],
+      "impactedAssets": [
+        "Tool execution within sandbox",
+        "Allowlisted network endpoints"
+      ],
+      "statement": "Prompt injection via inbound channels remains possible \u2014 NeMo Claw's sandbox confines the blast radius but does not prevent the injection. An attacker can still cause unintended tool calls and may exfiltrate data to any allowlisted external endpoint. The MR risk surface is unchanged; only the impact scope is reduced.",
+      "status": "identified",
+      "metadata": [
+        {
+          "key": "aivss-metric",
+          "value": "MR"
+        },
+        {
+          "key": "aivss-subCategory",
+          "value": "Prompt Injection Resistance"
+        },
+        {
+          "key": "aivss-severity",
+          "value": "High"
+        },
+        {
+          "key": "baseline-severity",
+          "value": "High"
+        },
+        {
+          "key": "severity-delta",
+          "value": "unchanged"
+        },
+        {
+          "key": "atlas-techniqueId",
+          "value": "AML.T0051"
+        },
+        {
+          "key": "atlas-techniqueName",
+          "value": "LLM Prompt Injection"
+        },
+        {
+          "key": "atlas-tactic",
+          "value": "Initial Access"
+        },
+        {
+          "key": "acsc-riskFamily",
+          "value": "design-and-configuration"
+        },
+        {
+          "key": "acsc-riskId",
+          "value": "acsc-dc-002"
+        },
+        {
+          "key": "nemoclaw-mitigated",
+          "value": "false"
+        },
+        {
+          "key": "nemoclaw-control",
+          "value": "None \u2014 injection occurs inside sandboxed process"
+        },
+        {
+          "key": "deploymentContext",
+          "value": "General"
+        },
+        {
+          "key": "priority",
+          "value": "high"
+        }
+      ]
+    },
+    {
+      "id": "t-002",
+      "numericId": 2,
+      "threatSource": "Malicious skill package from registry (e.g. ClawHub)",
+      "prerequisites": "User installs a skill from an unverified source",
+      "threatAction": "Malicious skill attempts to exfiltrate conversation data or establish persistence \u2014 contained by filesystem and network isolation",
+      "threatImpact": "Limited to /sandbox and /tmp; host filesystem and credentials inaccessible; network exfiltration restricted to allowlist",
+      "impactedGoal": [
+        "Confidentiality"
+      ],
+      "impactedAssets": [
+        "Data within /sandbox only"
+      ],
+      "statement": "The 900-malicious-package OpenClaw registry incident would have had significantly reduced impact under NeMo Claw. Malicious skills are confined to /sandbox \u2014 they cannot read openclaw.json, cannot reach unapproved hosts, and cannot persist outside the sandbox. The CS supply chain threat is materially reduced, though not eliminated: skills can still cause harm within their confined scope.",
+      "status": "identified",
+      "metadata": [
+        {
+          "key": "aivss-metric",
+          "value": "CS"
+        },
+        {
+          "key": "aivss-subCategory",
+          "value": "Third-Party Component Risk"
+        },
+        {
+          "key": "aivss-severity",
+          "value": "Medium"
+        },
+        {
+          "key": "baseline-severity",
+          "value": "High"
+        },
+        {
+          "key": "severity-delta",
+          "value": "reduced"
+        },
+        {
+          "key": "atlas-techniqueId",
+          "value": "AML.T0010"
+        },
+        {
+          "key": "atlas-techniqueName",
+          "value": "ML Supply Chain Compromise"
+        },
+        {
+          "key": "atlas-tactic",
+          "value": "Persistence"
+        },
+        {
+          "key": "acsc-riskFamily",
+          "value": "structural"
+        },
+        {
+          "key": "acsc-riskId",
+          "value": "acsc-s-001"
+        },
+        {
+          "key": "nemoclaw-mitigated",
+          "value": "partial"
+        },
+        {
+          "key": "nemoclaw-control",
+          "value": "Layer 2 Filesystem: /sandbox isolation. Layer 1 Network: egress allowlist."
+        },
+        {
+          "key": "deploymentContext",
+          "value": "General"
+        },
+        {
+          "key": "priority",
+          "value": "medium"
+        }
+      ]
+    },
+    {
+      "id": "t-003",
+      "numericId": 3,
+      "threatSource": "Compromised skill or injected agent action",
+      "prerequisites": "Attacker achieves code execution within OpenClaw process",
+      "threatAction": "Attempt to read openclaw.json for API keys and channel tokens \u2014 blocked by filesystem isolation",
+      "threatImpact": "Minimal: host filesystem is read-only outside /sandbox; credentials in openclaw.json inaccessible",
+      "impactedGoal": [
+        "Confidentiality"
+      ],
+      "impactedAssets": [
+        "In-process secrets only (if passed as env vars to sandbox)"
+      ],
+      "statement": "NeMo Claw's Layer 2 filesystem isolation directly mitigates credential theft from openclaw.json \u2014 the host filesystem is read-only from within the sandbox. Credentials passed as environment variables into the sandbox remain at-risk, but the primary attack vector (reading config files) is blocked. This is NeMo Claw's clearest win at the host layer.",
+      "status": "identified",
+      "metadata": [
+        {
+          "key": "aivss-metric",
+          "value": "DC"
+        },
+        {
+          "key": "aivss-subCategory",
+          "value": "Credential Storage Security"
+        },
+        {
+          "key": "aivss-severity",
+          "value": "Low"
+        },
+        {
+          "key": "baseline-severity",
+          "value": "Medium"
+        },
+        {
+          "key": "severity-delta",
+          "value": "reduced"
+        },
+        {
+          "key": "atlas-techniqueId",
+          "value": "AML.T0044"
+        },
+        {
+          "key": "atlas-techniqueName",
+          "value": "Full ML Model Access"
+        },
+        {
+          "key": "atlas-tactic",
+          "value": "Credential Access"
+        },
+        {
+          "key": "acsc-riskFamily",
+          "value": "privilege"
+        },
+        {
+          "key": "acsc-riskId",
+          "value": "acsc-p-001"
+        },
+        {
+          "key": "nemoclaw-mitigated",
+          "value": "true"
+        },
+        {
+          "key": "nemoclaw-control",
+          "value": "Layer 2 Filesystem: host FS read-only outside /sandbox. Layer 3 Process: Landlock prevents path traversal."
+        },
+        {
+          "key": "deploymentContext",
+          "value": "General"
+        },
+        {
+          "key": "priority",
+          "value": "low"
+        }
+      ]
+    },
+    {
+      "id": "t-004",
+      "numericId": 4,
+      "threatSource": "Prompt injection establishing a cron job",
+      "prerequisites": "Cron enabled; attacker achieves successful prompt injection",
+      "threatAction": "Schedule recurring autonomous job inside the sandbox \u2014 persists across conversation resets, executes without user confirmation",
+      "threatImpact": "Persistent autonomous execution within sandbox boundary; exfiltration limited to allowlisted endpoints",
+      "impactedGoal": [
+        "Integrity",
+        "Confidentiality"
+      ],
+      "impactedAssets": [
+        "Cron scheduler",
+        "In-sandbox data and tool access"
+      ],
+      "statement": "Cron persistence is unchanged by NeMo Claw. Scheduled jobs run inside the sandbox \u2014 the mechanism works, blast radius is contained, but the persistence itself is not prevented. An attacker who achieves one successful injection can establish a recurring presence that the user cannot see without the Approval TUI. This is NeMo Claw's most important residual risk at L1 Orchestration.",
+      "status": "identified",
+      "metadata": [
+        {
+          "key": "aivss-metric",
+          "value": "AA"
+        },
+        {
+          "key": "aivss-subCategory",
+          "value": "Autonomous Execution Control"
+        },
+        {
+          "key": "aivss-severity",
+          "value": "High"
+        },
+        {
+          "key": "baseline-severity",
+          "value": "High"
+        },
+        {
+          "key": "severity-delta",
+          "value": "unchanged"
+        },
+        {
+          "key": "atlas-techniqueId",
+          "value": "AML.T0080"
+        },
+        {
+          "key": "atlas-techniqueName",
+          "value": "Establish Persistence via Agent"
+        },
+        {
+          "key": "atlas-tactic",
+          "value": "Persistence"
+        },
+        {
+          "key": "acsc-riskFamily",
+          "value": "behaviour"
+        },
+        {
+          "key": "acsc-riskId",
+          "value": "acsc-b-003"
+        },
+        {
+          "key": "nemoclaw-mitigated",
+          "value": "false"
+        },
+        {
+          "key": "nemoclaw-control",
+          "value": "None \u2014 cron operates within sandbox boundary. Approval TUI provides visibility but not prevention."
+        },
+        {
+          "key": "deploymentContext",
+          "value": "General"
+        },
+        {
+          "key": "priority",
+          "value": "high"
+        }
+      ]
+    },
+    {
+      "id": "t-005",
+      "numericId": 5,
+      "threatSource": "Compromised device with personal and corporate channels connected",
+      "prerequisites": "Slack or Teams enabled; attacker achieves prompt injection or device access",
+      "threatAction": "Use assistant's channel access to send messages or extract data \u2014 network allowlist limits egress; Privacy Router strips PII in transit",
+      "threatImpact": "Reduced: network egress allowlist limits which endpoints can be reached; PII stripped by Privacy Router before external model calls",
+      "impactedGoal": [
+        "Confidentiality"
+      ],
+      "impactedAssets": [
+        "Corporate channel messages (partially mitigated)",
+        "User identity in transit"
+      ],
+      "statement": "NeMo Claw's egress allowlist and Privacy Router partially mitigate the personal-to-corporate pivot. Outbound data cannot reach arbitrary endpoints \u2014 only allowlisted hosts. PII is stripped before external model API calls. However, the channel access itself remains: if Slack and iMessage are both enabled, the assistant can still bridge between them within the sandbox. The residual risk is lower but not eliminated.",
+      "status": "identified",
+      "metadata": [
+        {
+          "key": "aivss-metric",
+          "value": "EI"
+        },
+        {
+          "key": "aivss-subCategory",
+          "value": "Cross-Context Data Leakage"
+        },
+        {
+          "key": "aivss-severity",
+          "value": "Medium"
+        },
+        {
+          "key": "baseline-severity",
+          "value": "High"
+        },
+        {
+          "key": "severity-delta",
+          "value": "reduced"
+        },
+        {
+          "key": "atlas-techniqueId",
+          "value": "AML.T0043"
+        },
+        {
+          "key": "atlas-techniqueName",
+          "value": "Craft Adversarial Data"
+        },
+        {
+          "key": "atlas-tactic",
+          "value": "Exfiltration"
+        },
+        {
+          "key": "acsc-riskFamily",
+          "value": "structural"
+        },
+        {
+          "key": "acsc-riskId",
+          "value": "acsc-s-002"
+        },
+        {
+          "key": "nemoclaw-mitigated",
+          "value": "partial"
+        },
+        {
+          "key": "nemoclaw-control",
+          "value": "Layer 1 Network: egress allowlist. Layer 4 Inference: Privacy Router strips PII before external model calls."
+        },
+        {
+          "key": "deploymentContext",
+          "value": "General"
+        },
+        {
+          "key": "priority",
+          "value": "medium"
+        }
+      ]
+    }
+  ],
+  "mitigations": [
+    {
+      "id": "m-001",
+      "numericId": 1,
+      "content": "[NeMo Claw \u2014 Residual] Per-channel trust tiers still required. NeMo Claw does not prevent prompt injection \u2014 it confines its blast radius. Implement message authenticity checks or per-sender trust scoring at the application layer."
+    },
+    {
+      "id": "m-002",
+      "numericId": 2,
+      "content": "[NeMo Claw \u2014 Mitigated] Filesystem isolation: skills confined to /sandbox. Malicious skill exfiltration paths to host credentials and arbitrary network endpoints are blocked by NeMo Claw Layer 2 + Layer 1."
+    },
+    {
+      "id": "m-003",
+      "numericId": 3,
+      "content": "[NeMo Claw \u2014 Mitigated] Host credential access blocked. openclaw.json is not readable from within the sandbox. Secrets passed as env vars remain at-risk \u2014 prefer in-sandbox secret management."
+    },
+    {
+      "id": "m-004",
+      "numericId": 4,
+      "content": "[NeMo Claw \u2014 Residual] Cron persistence remains possible inside the sandbox. Enable the Approval TUI for visibility into all scheduled jobs. Require explicit re-confirmation for cron jobs older than 7 days."
+    },
+    {
+      "id": "m-005",
+      "numericId": 5,
+      "content": "[NeMo Claw \u2014 Partial] Egress allowlist + Privacy Router reduce cross-context leakage. Separate corporate and personal channel profiles with explicit context-switch confirmation for cross-boundary tool calls."
+    }
+  ],
+  "mitigationLinks": [
+    {
+      "mitigationId": "m-001",
+      "linkedId": "t-001",
+      "type": "Threat"
+    },
+    {
+      "mitigationId": "m-002",
+      "linkedId": "t-002",
+      "type": "Threat"
+    },
+    {
+      "mitigationId": "m-003",
+      "linkedId": "t-003",
+      "type": "Threat"
+    },
+    {
+      "mitigationId": "m-004",
+      "linkedId": "t-004",
+      "type": "Threat"
+    },
+    {
+      "mitigationId": "m-005",
+      "linkedId": "t-005",
+      "type": "Threat"
+    }
+  ]
+}