feat(security): audit open ingress control-plane tool exposure by hugenshen · Pull Request #100965 · openclaw/openclaw

hugenshen · 2026-07-06T15:02:40Z

What Problem This Solves

gateway and cron are persistent control-plane write surfaces:

gateway can apply/patch live config (config.apply, config.patch, update.run)
cron can create scheduled jobs that survive the originating chat/task

src/security/dangerous-tools.ts already classifies both as high-risk / owner-only core tools, and public docs recommend denying them on untrusted surfaces. But the security audit had a visibility gap: existing exposure-matrix checks flagged elevated and runtime/filesystem tools on open ingress, not control-plane tools (gateway, cron).

Risk: an operator can run openclaw security audit, see exec/runtime warnings, and still miss that open group/DM ingress can reach agents with gateway or cron enabled.

Why This Change Was Made

Add a new exposure-matrix finding that mirrors the exec/runtime pattern:

Detect open inbound policies (listOpenInboundPolicies)
For each agent scope, resolve effective tool policies
If gateway and/or cron are allowed, emit security.exposure.open_groups_with_control_plane_tools (critical)

User Impact

Runtime: none
Operators: openclaw security audit may now report a new critical finding when open ingress and control-plane tools overlap

Evidence

pnpm test src/security/audit-trust-model.test.ts
node --import tsx scripts/proof-audit-control-plane-exposure.mjs

Test Files  1 passed (1)
     Tests  1 passed (1)

Real behavior proof

Behavior or issue addressed: Open ingress could reach gateway/cron without a dedicated security-audit finding.
Real environment tested: macOS (Darwin), Node.js v22.22.0.
Exact steps or command run after this patch:
1. node --import tsx scripts/proof-audit-control-plane-exposure.mjs
2. pnpm test src/security/audit-trust-model.test.ts
Evidence after fix:

$ node --import tsx scripts/proof-audit-control-plane-exposure.mjs
=== openclaw security audit exposure matrix (programmatic) ===

-- open group + coding profile --
[critical] security.exposure.open_groups_with_control_plane_tools: Open group/DM policy with gateway/cron control-plane tools exposed
Found inbound policy="open" at:
- channels.whatsapp.groupPolicy
Control-plane tool exposure contexts:
- agents.defaults (profile=coding; controlPlane=[cron])

-- open DM + tools.allow gateway --
[critical] security.exposure.open_groups_with_control_plane_tools: Open group/DM policy with gateway/cron control-plane tools exposed
Control-plane tool exposure contexts:
- agents.defaults (profile=none; controlPlane=[gateway])

-- open group + deny gateway/cron --
(no control-plane finding)

ALL PROOF ASSERTIONS PASSED

Observed result after fix: Open group with tools.profile="coding" emits a critical control-plane finding naming cron; open DM with explicit gateway allow is flagged; deny list suppresses the finding.
What was not tested: Full openclaw security audit CLI against a live config file on disk; proof uses the production exposure-matrix collector directly.

Checklist

New finding only fires on open inbound policies
Per-agent scope reporting (agents.defaults + agents.list.*)
Critical severity for persistent control-plane exposure
Regression tests for allow / deny / non-open ingress
Real behavior proof attached

AI-assisted disclosure

AI-assisted (Cursor agent)
Human-run Real behavior proof from local setup

clawsweeper · 2026-07-06T15:28:33Z

Codex review: needs maintainer review before merge. Reviewed July 7, 2026, 10:53 AM ET / 14:53 UTC.

Summary
The PR adds a critical security-audit exposure-matrix finding for open DM/group ingress that can reach gateway or cron, documents the check ID, and adds trust-model regression cases.

PR surface: Source +57, Tests +68, Docs +1. Total +126 across 3 files.

Reproducibility: yes. at source level: current main's exposure-matrix collector lacks a gateway/cron control-plane check while the CLI consumes that collector. The PR body includes after-fix terminal output from the production collector path, but I did not run tests in this read-only review.

Review metrics: 1 noteworthy metric.

Audit output contract: 1 critical check ID added. Security audit check IDs are operator-facing and can be consumed by suppressions, scripts, dashboards, and docs before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Resolve the merge conflict against current main before final merge review.
Get security-owner confirmation on the check ID and scope relative to security(audit): flag reachable plugin command chat surfaces #100945.

Risk before merge

[P1] The live PR is currently dirty/merge-conflicting, so the exact merge result still needs a rebase or conflict resolution before final merge review.
[P1] The PR adds a new critical, machine-readable security-audit check ID that may affect operator suppressions, scripts, dashboards, or docs consumers after upgrade.
[P1] The broader open PR at security(audit): flag reachable plugin command chat surfaces #100945 overlaps the same control-plane audit contract with additional plugin command-surface scope, so maintainers should choose the canonical scope before landing both paths.

Maintainer options:

Confirm focused contract before merge (recommended)
Have security owners accept the new check ID/scope, then rebase the branch and rerun the focused trust-model validation before merge.
Accept audit-output compatibility risk
Maintainers may intentionally accept that existing audit consumers can see a new critical check ID after upgrade because the finding improves operator visibility.
Pause behind the broader audit PR
If the broader PR should own the final contract, keep this PR paused until that replacement is proof-positive and viable.

Next step before merge

[P2] Manual review is required because the PR has a protected security label, changes an operator-facing audit-output contract, overlaps another open audit PR, and is currently merge-conflicting.

Maintainer decision needed

Question: Should this focused security.exposure.open_groups_with_control_plane_tools check be the canonical control-plane audit contract, or should that contract be folded into security(audit): flag reachable plugin command chat surfaces #100945?
Rationale: The PR changes security-audit output consumed by operators, carries a protected security label, and overlaps another open contributor PR with broader audit scope.
Likely owner: steipete — They have the clearest feature-history signal for the existing exposure-matrix audit behavior this PR extends.
Options:
- Land focused check after rebase (recommended): Accept this PR as the narrow control-plane exposure fix, resolve the merge conflict, and leave plugin command-surface auditing to separate work.
- Fold into broader audit PR: Use security(audit): flag reachable plugin command chat surfaces #100945 as the canonical audit contract only after it has sufficient proof and matching docs.
- Rename or rescope before merge: Ask the contributor to align the check ID and wording with the broader proposal before continuing merge review.

Security
Cleared: Cleared: the diff adds security-audit diagnostics, docs, and tests without changing dependencies, workflows, secrets handling, permissions, or runtime enforcement.

Review details

Best possible solution:

Land a rebased, maintainer-approved focused audit contract, or explicitly fold this control-plane check into the broader audit PR if security owners choose that as the canonical path.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level: current main's exposure-matrix collector lacks a gateway/cron control-plane check while the CLI consumes that collector. The PR body includes after-fix terminal output from the production collector path, but I did not run tests in this read-only review.

Is this the best way to solve the issue?

Yes for the focused gap: extending the existing exposure matrix is the narrow owner-boundary fix for this diagnostic. The merge-ready solution still needs maintainer-confirmed check ID/scope and a rebase because the live PR is dirty.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 72ca911e3c33.

Label changes

Label justifications:

P2: This is a normal-priority security-audit improvement with no runtime enforcement change and a bounded operator-facing blast radius.
merge-risk: 🚨 compatibility: The PR adds a new critical security-audit check ID that existing audit consumers may need to recognize after upgrade.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): Sufficient terminal proof: the PR body shows after-fix output from a macOS Node run of the production exposure-matrix collector plus the focused test result; full CLI proof would improve confidence but is not required for this collector-only change.
proof: sufficient: Contributor real behavior proof is sufficient. Sufficient terminal proof: the PR body shows after-fix output from a macOS Node run of the production exposure-matrix collector plus the focused test result; full CLI proof would improve confidence but is not required for this collector-only change.

Evidence reviewed

PR surface:

Source +57, Tests +68, Docs +1. Total +126 across 3 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	58	1	+57
Tests	1	68	0	+68
Docs	1	1	0	+1
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	3	127	1	+126

What I checked:

PR head adds the control-plane exposure finding: At PR head, collectExposureMatrixFindings calls collectControlPlaneToolExposureContexts and emits security.exposure.open_groups_with_control_plane_tools as a critical finding with gateway/cron remediation. (src/security/audit-extra.sync.ts:1253, dcfefa9c8072)
PR head resolves the previous docs blocker: The PR head adds the new machine-readable check ID to the public audit-check catalog. Public docs: docs/gateway/security/audit-checks.md. (docs/gateway/security/audit-checks.md:115, dcfefa9c8072)
PR head adds focused regression coverage: The added trust-model cases cover open group policy with the coding profile, explicit gateway allow, explicit deny, and non-open ingress. (src/security/audit-trust-model.test.ts:235, dcfefa9c8072)
Current main lacks the central requested check: Current main has elevated and runtime/filesystem open-ingress checks but no control-plane check in collectExposureMatrixFindings; a repository search also found no open_groups_with_control_plane check ID on main. (src/security/audit-extra.sync.ts:1174, 72ca911e3c33)
The audit CLI consumes this collector: runSecurityAudit appends collectExposureMatrixFindings(cfg), so the PR changes openclaw security audit output rather than dead code. (src/security/audit.ts:1413, 72ca911e3c33)
Gateway and cron are already treated as high-risk control-plane tools: Current main classifies cron and gateway as dangerous Gateway HTTP tools and owner-only core tools, matching the PR's security model. (src/security/dangerous-tools.ts:28, 72ca911e3c33)

Likely related people:

steipete: Introduced the existing open-group runtime/filesystem exposure-matrix pattern this PR extends and the nearby multi-user trust-model audit behavior. (role: security audit feature-history contributor; confidence: high; commits: 049b8b14bc78, 4d124e4a9b75; files: src/security/audit-extra.sync.ts)
Takhoffman: Authored the data-driven tool catalog history that defines cron as part of the coding profile and gateway as an automation tool, which the new audit check relies on. (role: adjacent tool-catalog contributor; confidence: medium; commits: 9e1a13bf4c6a; files: src/agents/tool-catalog.ts)
VectorPeak: Current line blame for the audit collector, docs catalog, dangerous-tool constants, and tool catalog points at a broad recent commit, though the commit subject is not specific to this audit feature. (role: recent line-blame contributor; confidence: low; commits: cd5c3fc3b779; files: src/security/audit-extra.sync.ts, docs/gateway/security/audit-checks.md, src/security/dangerous-tools.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (3 earlier review cycles)

reviewed 2026-07-06T15:35:21.792Z sha 0b72cd5 :: needs real behavior proof before merge. :: [P2] Document the new audit check ID
reviewed 2026-07-06T17:27:13.190Z sha d4b5abb :: found issues before merge. :: [P2] Document the new audit check ID | [P2] Remove the checked-in PR body file
reviewed 2026-07-07T14:33:10.708Z sha a671c12 :: needs maintainer review before merge. :: none

hugenshen · 2026-07-06T16:57:42Z

@clawsweeper re-review

clawsweeper · 2026-07-06T16:57:46Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Co-authored-by: NIO <[email protected]>

steipete · 2026-07-11T19:36:41Z

Merged via squash.

Prepared head SHA: 9ddbd725d2565d6f2c70f9ff198cbbb9a5a201aa
Landed commit: 589f1c00de3204a3d8e14ad6afca99aada8e8745

…law#100965) * fix(security): audit open control-plane exposure Co-authored-by: NIO <[email protected]> * chore: keep sweep changelog neutral --------- Co-authored-by: Peter Steinberger <[email protected]> Co-authored-by: NIO <[email protected]>

hugenshen requested a review from a team as a code owner July 6, 2026 15:02

openclaw-barnacle Bot added the size: S label Jul 6, 2026

openclaw-barnacle Bot added scripts Repository scripts size: M and removed size: S labels Jul 6, 2026

clawsweeper Bot mentioned this pull request Jul 7, 2026

security(audit): flag reachable plugin command chat surfaces #100945

Closed

2 tasks

hugenshen force-pushed the codex/audit-control-plane-exposure branch from d4b5abb to a671c12 Compare July 7, 2026 14:21

openclaw-barnacle Bot added docs Improvements or additions to documentation gateway Gateway runtime security Security documentation labels Jul 7, 2026

hugenshen force-pushed the codex/audit-control-plane-exposure branch from a671c12 to dcfefa9 Compare July 7, 2026 14:40

openclaw-barnacle Bot added size: S and removed scripts Repository scripts size: M labels Jul 7, 2026

steipete self-assigned this Jul 11, 2026

steipete and others added 2 commits July 11, 2026 15:18

fix(security): audit open control-plane exposure

b14587f

Co-authored-by: NIO <[email protected]>

chore: keep sweep changelog neutral

9ddbd72

steipete force-pushed the codex/audit-control-plane-exposure branch from dcfefa9 to 9ddbd72 Compare July 11, 2026 19:26

openclaw-barnacle Bot added agents Agent runtime and tooling size: M and removed size: S labels Jul 11, 2026

steipete merged commit 589f1c0 into openclaw:main Jul 11, 2026
115 of 117 checks passed

github-actions Bot mentioned this pull request Jul 11, 2026

📡 Upstream Digest — 2026-07-11 20:39 UTC curtismercier/openclaw-mods#1265

Open

clawsweeper Bot mentioned this pull request Jul 11, 2026

test(cron): add restart catch-up coverage for recurring command jobs #104707

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(security): audit open ingress control-plane tool exposure#100965

feat(security): audit open ingress control-plane tool exposure#100965
steipete merged 2 commits into
openclaw:mainfrom
hugenshen:codex/audit-control-plane-exposure

hugenshen commented Jul 6, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

hugenshen commented Jul 6, 2026

Uh oh!

clawsweeper Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

steipete commented Jul 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

hugenshen commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Real behavior proof

Checklist

AI-assisted disclosure

Uh oh!

clawsweeper Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hugenshen commented Jul 6, 2026

Uh oh!

clawsweeper Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

steipete commented Jul 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hugenshen commented Jul 6, 2026 •

edited

Loading

clawsweeper Bot commented Jul 6, 2026 •

edited

Loading

clawsweeper Bot commented Jul 6, 2026 •

edited

Loading