OpenClaw (Moltbot) — agentic threat model

Not certain from the listing — The specific LLMs or foundation models utilized are not detailed, though as a self-hosted tool it likely supports various local or API-based models. Risks include prompt injection bypassing local constraints and model reprogramming.

Not certain from the listing — The exact data storage, vector database, or RAG mechanisms are unspecified. However, the agent processes highly sensitive personal data (emails, chat histories, calendars), making data exfiltration via prompt injection a severe threat.

The agent framework orchestrates tool calling, gateway routing, and a skills ecosystem. The primary threat is tool misuse, where malicious inputs could trick the agent into sending unauthorized emails, deleting calendar events, or executing unintended workflows.

As a self-hosted application with a local dashboard, the deployment infrastructure is highly critical. Threats include host compromise if the local dashboard is exposed, privilege escalation, and insecure storage of API keys/session tokens for WhatsApp, Telegram, and Email.

Not certain from the listing — While onboarding and diagnostics commands are mentioned alongside a local dashboard, there is no evidence of robust, automated guardrails, real-time anomaly detection, or alignment monitoring.

Not certain from the listing — Being an open-source, self-hosted personal assistant, it lacks formal compliance certifications (e.g., SOC2, ISO). Security controls, access management, and policy enforcement are left entirely to the end-user's configuration.

The agent features an 'ecosystem of skills and integrations'. This introduces supply-chain risks where compromised or malicious third-party skills could be loaded into the assistant, leading to unauthorized data access or remote code execution.