refactor: moved org-agent to its own repository as a submodule

2026-03-27 15:46:53 -04:00
parent 01f76a4570
commit b7e082c403
176 changed files with 19686 additions and 9665 deletions
--- a/system/security-implementation.org
+++ b/system/security-implementation.org
@@ -0,0 +1,154 @@
+#+TITLE: Security Implementation - Priority 1 Fixes
+#+author: Amero Garcia
+#+created: [2026-03-16 Mon 14:28]
+#+DATE: 2026-03-04
+#+FILETAGS: :security:implementation:priority1
+
+* Priority 1: Immediate Security Fixes
+
+** Implementation Start
+Time: 2026-03-04 21:26 EST
+Authorization: User granted
+
+---
+
+* Fix 1: Audit Current Credentials Exposure
+
+** Step 1.1: Identify all credentials in context
+
+| Credential Type | Location | Exposure Risk | Status |
+|-----------------|----------|---------------|--------|
+| X API Keys | ~/.openclaw/credentials/ | LOW (file system, not context) | SECURED |
+| App Passwords | ~/.openclaw/credentials/ | LOW (file system, not context) | SECURED |
+| Gateway Token | openclaw.json | MEDIUM (config file) | REVIEWING |
+| Browser CDP | Port 9222 | MEDIUM (local network) | REVIEWING |
+
+** Step 1.2: Analyze conversation history
+
+- Check if credentials ever loaded into agent context
+- Review memory files for credential leakage
+- Verify git history doesn't contain secrets
+
+---
+
+* Fix 2: Isolate Credentials from Prompt Context
+
+** Current Problem:**
+- Credentials directory accessible to agent
+- Could accidentally read into context
+- Memory system might cache credential content
+
+** Fix: Disable credential loading**
+
+Add to openclaw.json:
+```json
+"security": {
+  "credentialIsolation": {
+    "enabled": true,
+    "forbiddenPaths": [
+      "~/.openclaw/credentials/",
+      "**/credentials/",
+      "**/*password*",
+      "**/*secret*",
+      "**/*key*"
+    ],
+    "loadMode": "toolOnly",
+    "contextLoad": false
+  }
+}
+```
+
+** Implementation:**
+- Protect credentials directory from read() tool
+- Only access via exec() with explicit paths
+- Audit all credential access attempts
+
+---
+
+* Fix 3: Document Attack Surface
+
+** Current Attack Vectors:**
+
+1. *Local Network*
+   - Gateway on ws://127.0.0.1:18789
+   - CDP on http://127.0.0.1:9222
+   - Unencrypted local traffic
+
+2. *Group Chat Context*
+   - Agent receives all messages
+   - No message filtering
+   - Full tool access
+
+3. *External Content*
+   - Web fetch results unsanitized
+   - Search API returns untrusted content
+   - No content validation
+
+4. *File System*
+   - Broad file read access
+   - Can access OS config
+   - Credential files accessible
+
+** Mitigation Status:**
+TODO  Network encryption (TLS)
+TODO  Group chat sandboxing
+TODO  Content sanitization
+TODO  File access restrictions
+
+---
+
+* Fix 4: Tool Allowlists (Priority 1.5)
+
+** Group Chat Restrictions:**
+
+| Tool | Group Chat | DM | Notes |
+|------|------------|-----|-------|
+| read | ALLOWED | ALLOWED | Files only |
+| write | FORBIDDEN | ALLOWED | With confirmation |
+| edit | FORBIDDEN | ALLOWED | With confirmation |
+| exec | FORBIDDEN | ALLOWED | Restricted commands |
+| delete | FORBIDDEN | FORBIDDEN | Always forbidden |
+| message | ALLOWED | ALLOWED | Rate limited |
+| web_search | ALLOWED | ALLOWED | Safe |
+| browser | FORBIDDEN | ALLOWED | Security risk |
+
+** Implementation:**
+```json
+"channels": {
+  "signal": {
+    "groupPolicy": "restrictive",
+    "toolAllowlist": ["read", "web_search", "message", "sessions_send"],
+    "toolBlocklist": ["write", "edit", "exec", "browser"]
+  }
+}
+```
+
+---
+
+* Implementation Checklist
+
+** Today (Next 30 minutes):**
+TODO  Review all credentials exposure (COMPLETED)
+TODO  Implement credential isolation (IN PROGRESS)
+TODO  Document attack surface (IN PROGRESS)
+TODO  Configure tool allowlists
+TODO  Test group chat restrictions
+TODO  Verify fixes work
+
+** Verification:**
+TODO  Credentials not accessible via read()
+TODO  Group chat agent cannot write files
+TODO  External content marked as untrusted
+TODO  Audit log captures all credential access
+
+---
+
+* Continuation Criteria
+
+Before proceeding with X API access:
+1. ✅ All Priority 1 fixes complete
+2. ✅ User verifies restrictions work
+3. ✅ Credentials accessed via secure method only
+4. ✅ Audit trail in place
+
+*ETA:* 30 minutes for Priority 1 fixes