Threat Model — ThreatClaw Trust

Architecture Security Summary

Rust core (memory-safe) · wasmtime 36 sandbox · 35-command whitelist · 17-category anonymizer · Argon2id vault · HMAC audit chain

0 CVE OWASP ASI 9/9 Rust Only

5 Immutable Security Pillars Compiled into binary

Soul SHA-256

Identity hash compiled in binary. Tamper = no start.

Whitelist 35 cmd

Pre-approved commands only. No shell. Anti-injection.

III

XML Wrapper

25+ injection patterns blocked. Data stays data.

HMAC Memory

Every memory entry signed. Tampering detected.

Kill Switch

8 auto triggers. Atomic stop + forensic snapshot.

Reconnaissance AML.TA0002

ID	Threat	ATLAS	Severity	Mitigation
T-RECON-001	Agent endpoint discovery Network scan to identify dashboard (3001) and Rust API (3000) on LAN	AML.T0006	Medium	Nginx reverse proxy — internal ports not exposed
T-RECON-002	Skills enumeration List active skills via API to map remediation capabilities	AML.T0006	Low	Auth required on all API routes
T-RECON-003	Sigma rules extraction Extract Sigma rules to evade SOC detection	AML.T0006	Medium	Rules not exposed via API — DB access required
T-RECON-004	Whitelist enumeration Extract 35-command whitelist to plan evasion	AML.T0006	Medium	Compiled in Rust binary — not readable via API

Initial Access AML.TA0004

ID	Threat	ATLAS	Severity	Mitigation
T-ACCESS-001	Dashboard JWT theft Interception of authentication JWT token	AML.T0040	High	Short-lived JWT (1h) + HttpOnly refresh cookie
T-ACCESS-002	Malicious community skill Compromised Python skill from community — primary supply chain vector	AML.T0010	Critical	Docker isolation (network:none, 256MB, RO FS) + code review + BLAKE3 signing for official WASM
T-ACCESS-003	Poisoned skill update Malicious payload via seemingly legitimate update	AML.T0010	High	BLAKE3 signature verified on every WASM load
T-ACCESS-004	Prompt injection via external data Malicious content in CVE feeds/DMARC reports processed by LLM	AML.T0051	High	Pillar III: XML wrapper on all tool outputs. 25+ injection patterns blocked.
T-ACCESS-005	Physical server access Physical access allowing DB or credential vault extraction	AML.T0040	High	Vault encrypted (Argon2id + AES-256-GCM). Disk encryption recommended.
T-ACCESS-006	Channel impersonation Commands via compromised Slack/Telegram to trigger remediation	AML.T0040	High	Webhook signature + nonce anti-replay + DM pairing + 15min timeout

Execution AML.TA0005

ID	Threat	ATLAS	Severity	Mitigation
T-EXEC-001	Direct LLM prompt injection Injection via Slack/dashboard to manipulate remediation decisions	AML.T0051	Critical	Pillar I Soul + Pillar II 35-command whitelist. LLM cannot execute outside whitelist. 4-level permission system.
T-EXEC-002	Indirect injection via scan data Payload in Nuclei/Trivy results to alter LLM behavior	AML.T0051	High	Pillar III XML wrapper + 17-category anonymizer. Structured JSON output only.
T-EXEC-003	WASM sandbox escape Exploit wasmtime to execute native code outside sandbox	AML.T0010	Critical	wasmtime 36.0.6 (4 CVEs patched, 0 remaining). Fuel metering 1.2B ops. 10MB memory. BLAKE3 verified.
T-EXEC-004	HITL approval bypass Manipulate Slack Block Kit to trigger unapproved remediation	AML.T0043	High	Webhook signature + unique nonce + 15min timeout + anti-replay
T-EXEC-005	Command parameter injection Shell metacharacters in whitelist command parameters	AML.T0051	High	16 forbidden chars validated. Path traversal blocked. Forbidden targets. No shell=true ever.
T-EXEC-006	Skill API lookup abuse LLM floods skill lookups to exhaust API rate limits	AML.T0031	Medium	Max iterations per ReAct cycle. Cooldown between runs. Rate limits per skill.

Persistence AML.TA0006

ID	Threat	ATLAS	Severity	Mitigation
T-PERSIST-001	Persistent malicious skill Compromised skill reloaded by scheduler automatically	AML.T0010	Critical	Docker network:none. WASM BLAKE3 verified on load. Skill disable stops immediately.
T-PERSIST-002	Vector memory poisoning Inject malicious data in pgvector to bias future LLM decisions	AML.T0051	High	Pillar IV: HMAC-SHA256 on every memory entry. Tools read-only. Tampering detected next cycle.
T-PERSIST-003	Scheduler config tampering Alter cron routines to silently disable scans	AML.T0010	Medium	Config compiled in binary. Change requires binary replacement → Soul hash mismatch → no start.
T-PERSIST-004	Stolen channel token reuse Reuse stolen Slack/Telegram token for persistent HITL access	AML.T0040	Medium	Encrypted vault (Argon2id + AES-256-GCM). Token rotation via dashboard.

Defense Evasion AML.TA0007

ID	Threat	ATLAS	Severity	Mitigation
T-EVADE-001	Sigma rule evasion Adapt TTPs to avoid triggering Sigma detections	AML.T0043	High	Sigma rules updatable. LLM correlation adds behavioral layer. ML detection planned v1.0.
T-EVADE-002	Multi-stage skill payload Benign skill downloads second-stage payload post-install	AML.T0043	High	WASM network=false. Docker network:none + read-only FS. HTTP blocked unless allowlisted in skill.json.
T-EVADE-003	Anonymizer bypass via encoding Obfuscate sensitive data to bypass anonymizer before cloud LLM	AML.T0043	Medium	17 categories + RSSI custom rules. Base64/hex patterns planned v1.0.
T-EVADE-004	Audit log tampering Modify or delete audit entries to hide actions	AML.T0043	Medium	HMAC chain in PostgreSQL. SQL trigger prevents modification — even by DBA.

Discovery AML.TA0008

ID	Threat	ATLAS	Severity	Mitigation
T-DISC-001	Credential vault extraction Access API keys via compromised skill	AML.T0040	Critical	Secrets injected at host boundary — never in WASM. Vault: Argon2id (m=64MiB, t=3) + AES-256-GCM + HKDF-SHA256.
T-DISC-002	Scan data enumeration Access CVEs, secrets, dark web results in PostgreSQL	AML.T0040	Medium	PostgreSQL Docker-internal only. No public port.
T-DISC-003	Target infrastructure mapping Extract configured targets to map client infrastructure	AML.T0040	High	API requires auth. Anonymizer strips IPs/hostnames before cloud LLM.

Exfiltration AML.TA0010

ID	Threat	ATLAS	Severity	Mitigation
T-EXFIL-001	Data exfiltration via cloud LLM Real data sent unanonymized to Mistral/Claude API	AML.T0009	Critical	17-category anonymizer before every cloud call. User-controlled flag. IPs→[IP-001]. Reversible locally only.
T-EXFIL-002	Credential theft via skill Skill exfiltrates API keys to external endpoint	AML.T0009	Critical	WASM: network=false + host boundary injection + leak detection. Docker: network:none + allowlist.
T-EXFIL-003	Report exfiltration Unauthorized access to NIS2/ISO compliance reports	AML.T0009	High	Reports stored locally — no cloud sync. Dashboard auth required.
T-EXFIL-004	Anonymizer rules leak Extract RSSI custom patterns to understand what's considered sensitive	AML.T0009	Medium	Rules in PostgreSQL (Docker internal). API requires auth. Only regex patterns, no actual data.

Impact AML.TA0011

ID	Threat	ATLAS	Severity	Mitigation
T-IMPACT-001	Unauthorized remediation Automatic remediation without RSSI approval	AML.T0031	Critical	4-level permissions. AUTO disabled by default. HITL for HIGH/CRITICAL. Pillar V Kill Switch: 8 triggers.
T-IMPACT-002	False positive flooding Mass false positives to mask real non-compliance	AML.T0031	Medium	Weighted scoring + history. Anomaly detection planned v1.0.
T-IMPACT-003	Scheduler DoS Saturate scheduler to prevent planned scans	AML.T0031	High	Nginx rate limit (30r/s) + Docker resource limits + cooldown
T-IMPACT-004	PostgreSQL destruction Delete scan history, rules, reports via compromised access	AML.T0031	High	HMAC audit chain prevents silent modification. Docker-internal only. Backup recommended.

Critical Attack Chains

Supply Chain Skill — Primary Kill Chain

T-RECON-002→T-ACCESS-002→T-EXEC-003→T-PERSIST-001→T-EXFIL-002

Skill enumeration → Malicious skill → WASM escape → Scheduler persistence → Credential theft

✓ Mitigated: BLAKE3 + Docker network:none + leak detection + fuel metering + wasmtime 36 (0 CVE)

Data Exfiltration via Cloud LLM

T-ACCESS-004→T-EXEC-002→T-EXFIL-001→T-IMPACT-002

External data injection → LLM manipulation → Unanonymized data to cloud → False reports

✓ Mitigated: Rust anonymizer (17 categories) before every cloud call — architectural layer

Unauthorized Remediation (HITL Bypass)

T-ACCESS-006→T-EXEC-001→T-EXEC-004→T-IMPACT-001

Channel impersonation → LLM manipulation → Approval bypass → Destructive remediation

✓ Mitigated: Webhook signature + nonce + AUTO disabled by default + Kill Switch 8 triggers

Physical Access → Total Extraction

T-ACCESS-005→T-DISC-001→T-EXFIL-003→T-IMPACT-004

Physical access → DB + vault extraction → Report exfiltration → Data destruction

⚠ Partially mitigated: Vault encrypted (Argon2id). Full disk encryption = deployment prerequisite.

Trust Boundaries

Skill Supply Chain

GitHub + local skills-src/

Official: Rust/WASM + BLAKE3

Community: Python/Docker isolated

Manual code review before merge

Capability declaration in skill.json

WASM Sandbox

wasmtime 36.0.6 — 0 CVE

Fuel: 1.2B ops max

Memory: 10MB max

Secrets at host boundary only

Leak detection on outputs

HTTP allowlist per skill

LLM Layer

Ollama local / Cloud anonymized

17-category anonymizer

Custom RSSI patterns via API

3-level escalation (L1→L2→L3)

User-controlled anonymize flag

Air-gap mode (Ollama only)

HITL Channels

Slack · Telegram · Discord · WhatsApp · Signal

Webhook signature verification

Nonce anti-replay per action

15min timeout auto-expiration

DM pairing security

Whitelist Executor

35 commands — Rust compiled

27 system commands

8 skill API lookups (read-only)

16 forbidden chars per param

No shell=true — subprocess only

Data at Rest

PostgreSQL 16 + pgvector

Docker internal network only

Argon2id + AES-256-GCM vault

HMAC audit chain (immutable)

Configurable data retention