OpenClaw MAESTRO

What it is

A threat model applying the MAESTRO framework (7-layer agentic AI security model) to the OpenClaw messaging agent codebase, enumerated as numbered threat IDs with severity ratings and pointers to the specific source files where each mitigation lives. The fetched text covers Layer 1 (Foundation Models: LM-001 through LM-005) and Layer 2 (Data Operations: DO-001 through DO-003, cut off mid-sentence). It is an author-run analysis inviting comment, not a vendor advisory.

How it works

Each threat pairs an attack with an in-tree mitigation. The concrete claims worth carrying past the summary:

• LM-001 prompt injection — mitigated by input sanitization in src/agents/pi-embedded-helpers.ts (strips thought signatures, sanitizes tool calls), model failover in src/agents/model-fallback.ts on detected abuse, context-overflow guards in src/agents/context-window-guard.ts, a /think depth limit, and periodic session compaction in src/agents/compaction.ts.
• LM-002 multi-turn jailbreak — the same compaction/reset machinery limits the gradual-manipulation window.
• LM-003 API key exposure — src/config/config.ts rejects world-readable config; src/security/audit.ts reports it.
• LM-005 system-prompt leak — bootstrap in src/agents/bootstrap-files.ts varies prompt construction per session to defeat pattern extraction of AGENTS.md / SOUL.md / TOOLS.md.
• DO-001 plaintext credentials — pairing store uses 1-hour-TTL codes, caps pending requests at 3 per channel, and uses an alphabet excluding ambiguous characters.

Preconditions / Affected

Threats center on filesystem access to ~/.openclaw/: config keys in ~/.openclaw/openclaw.json, credentials in ~/.openclaw/credentials/, and session/history data. The credential and state-directory risks (DO-001, DO-002) matter specifically on multi-user hosts where other local users can read the state directory.

What to do

Concrete, page-stated actions:

• Set the state directory to permission mode 0o700.
• Run OpenClaw's own audit command (src/security/audit.ts), which flags world-writable/world-readable state and credential directories with severity levels.
• Store credentials via OS keychain integration rather than the default plaintext JSON.

Caveats

• Coverage is partial: only MAESTRO Layers 1–2 appear, and DO-003 is truncated in the fetched text — Layers 3–7 are not present.
• Several mitigations are stated as recommendations ("Credentials should be stored using OS keychain integration"), not confirmed defaults, so a reader must verify current behavior against the codebase rather than assume it.
• This is an individual's threat-model post soliciting corrections ("comment below if we missed anything"), not an authoritative security review.