Threat Model Spec v0.6.0 Enhancement Plan

Status: Complete

Goal: Add OWASP Agentic Security (ASI) support and OWASP reference data

Overview

The OpenClaw vulnerability analysis revealed gaps in the current spec:

1. No ASI support — The new OWASP Top 10 for Agentic Applications (2026) isn't supported
2. No OWASP reference data — Framework IDs are unvalidated strings; no official names/descriptions
3. ASI IDs in Attack steps — Need asiIds field like owaspIds

Background

OWASP now maintains four Top 10 lists relevant to threat modeling:

List	Year	Focus
API Security Top 10	2023	API vulnerabilities
LLM Applications Top 10	2025	LLM-specific risks
Web Application Top 10	2021	Traditional web vulnerabilities
Agentic Applications Top 10 (ASI)	2026	Autonomous AI agent risks

The ASI list is particularly relevant for AI coding agents like OpenClaw, addressing risks like:

• ASI02: Tool Misuse & Exploitation
• ASI03: Agent Identity & Privilege Abuse
• ASI04: Agentic Supply Chain Compromise
• ASI05: Unexpected Code Execution
• ASI09: Human-Agent Trust Exploitation

Planned Enhancements

1. Add OWASP Agentic Category

Priority: High

Add agentic to the OWASPCategory enum.

Changes to ir/mappings.go:

const (
    OWASPCategoryAPI     OWASPCategory = "api"     // API Security Top 10
    OWASPCategoryLLM     OWASPCategory = "llm"     // LLM Application Top 10
    OWASPCategoryWeb     OWASPCategory = "web"     // Web Application Top 10
    OWASPCategoryAgentic OWASPCategory = "agentic" // Agentic Applications Top 10 (ASI)
)

JSONSchema update:

func (OWASPCategory) JSONSchema() *jsonschema.Schema {
    return &jsonschema.Schema{
        Type: "string",
        Enum: []any{"api", "llm", "web", "agentic"},
    }
}

2. Add ASI IDs to Attack Struct

Priority: High

Add asiIds field to the Attack struct for per-step ASI mappings.

Changes to ir/diagram.go:

type Attack struct {
    // ... existing fields

    // ASIIds lists applicable OWASP Agentic Security categories.
    // Example: ["ASI02:2026", "ASI03:2026"]
    ASIIds []string `json:"asiIds,omitempty"`
}

3. OWASP Reference Data

Priority: Medium

Add reference data for all four OWASP Top 10 lists with official IDs, names, and descriptions.

New file: ir/owasp_reference.go:

package ir

// OWASPEntry contains reference data for an OWASP Top 10 entry.
type OWASPEntry struct {
    ID          string `json:"id"`
    Name        string `json:"name"`
    Description string `json:"description"`
    URL         string `json:"url"`
}

// OWASP API Security Top 10 (2023)
var OWASPAPITop10 = map[string]OWASPEntry{
    "API1:2023": {
        ID:          "API1:2023",
        Name:        "Broken Object Level Authorization",
        Description: "APIs expose endpoints that handle object identifiers, creating attack surface for BOLA.",
        URL:         "https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/",
    },
    "API2:2023": {
        ID:          "API2:2023",
        Name:        "Broken Authentication",
        Description: "Authentication mechanisms are often implemented incorrectly.",
        URL:         "https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/",
    },
    // ... remaining entries
}

// OWASP LLM Top 10 (2025)
var OWASPLLMTop10 = map[string]OWASPEntry{
    "LLM01:2025": {
        ID:          "LLM01:2025",
        Name:        "Prompt Injection",
        Description: "Manipulating LLMs via crafted inputs to cause unintended actions.",
        URL:         "https://genai.owasp.org/llmrisk/llm01-prompt-injection/",
    },
    // ... remaining entries
}

// OWASP Web Top 10 (2021)
var OWASPWebTop10 = map[string]OWASPEntry{
    "A01:2021": {
        ID:          "A01:2021",
        Name:        "Broken Access Control",
        Description: "Access control enforces policy such that users cannot act outside their permissions.",
        URL:         "https://owasp.org/Top10/A01_2021-Broken_Access_Control/",
    },
    // ... remaining entries
}

// OWASP Agentic Top 10 (ASI 2026)
var OWASPAgenticTop10 = map[string]OWASPEntry{
    "ASI01:2026": {
        ID:          "ASI01:2026",
        Name:        "Agentic Prompt Injection",
        Description: "Malicious instructions injected into agent's context through various input channels.",
        URL:         "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/",
    },
    "ASI02:2026": {
        ID:          "ASI02:2026",
        Name:        "Tool Misuse & Exploitation",
        Description: "Attackers exploit agent's access to tools to perform unauthorized actions.",
        URL:         "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/",
    },
    // ... remaining entries
}

// GetOWASPEntry returns the reference data for an OWASP ID, or nil if not found.
func GetOWASPEntry(id string) *OWASPEntry {
    if e, ok := OWASPAPITop10[id]; ok {
        return &e
    }
    if e, ok := OWASPLLMTop10[id]; ok {
        return &e
    }
    if e, ok := OWASPWebTop10[id]; ok {
        return &e
    }
    if e, ok := OWASPAgenticTop10[id]; ok {
        return &e
    }
    return nil
}

// ValidateOWASPID checks if an OWASP ID is recognized.
func ValidateOWASPID(id string) bool {
    return GetOWASPEntry(id) != nil
}

4. OWASP Validation

Priority: Medium

Add optional validation to check that OWASP IDs in mappings are recognized.

Changes to ir/validate.go:

// ValidateOWASPMappings checks that OWASP IDs are recognized.
// Returns warnings (not errors) for unrecognized IDs.
func (d *DiagramIR) ValidateOWASPMappings() []string {
    var warnings []string

    // Check top-level OWASP mappings
    if d.Mappings != nil {
        for _, m := range d.Mappings.OWASP {
            if !ValidateOWASPID(m.ID) {
                warnings = append(warnings, fmt.Sprintf("unrecognized OWASP ID: %s", m.ID))
            }
        }
    }

    // Check attack step OWASP IDs
    for _, a := range d.Attacks {
        for _, id := range a.OWASPIds {
            if !ValidateOWASPID(id) {
                warnings = append(warnings, fmt.Sprintf("attack step %d: unrecognized OWASP ID: %s", a.Step, id))
            }
        }
        for _, id := range a.ASIIds {
            if !ValidateOWASPID(id) {
                warnings = append(warnings, fmt.Sprintf("attack step %d: unrecognized ASI ID: %s", a.Step, id))
            }
        }
    }

    return warnings
}

5. Schema Regeneration

Priority: High

Regenerate JSON schemas after type additions.

go run cmd/genschema/main.go schema/ v0.6.0

6. Documentation Updates

Priority: Medium

• Update docs/concepts/frameworks/owasp.md with ASI section
• Add docs/concepts/frameworks/owasp-asi.md for detailed ASI coverage
• Update README.md with ASI support

Implementation Order

Phase 1: Core ASI Support (High Priority)

Task	Description
1.1	Add OWASPCategoryAgentic to ir/mappings.go
1.2	Update OWASPCategory.JSONSchema() to include "agentic"
1.3	Add ASIIds []string field to Attack struct in ir/diagram.go
1.4	Update version to v0.6.0 in cmd/genschema/main.go
1.5	Regenerate JSON schemas
1.6	Add unit tests for new category and field

Phase 2: OWASP Reference Data (Medium Priority)

Task	Description
2.1	Create ir/owasp_reference.go with OWASPEntry type
2.2	Add OWASP API Security Top 10 (2023) reference data
2.3	Add OWASP LLM Top 10 (2025) reference data
2.4	Add OWASP Web Top 10 (2021) reference data
2.5	Add OWASP Agentic Top 10 (ASI 2026) reference data
2.6	Add GetOWASPEntry() and ValidateOWASPID() functions
2.7	Add unit tests for reference data

Phase 3: Validation & Documentation (Medium Priority)

Task	Description
3.1	Add ValidateOWASPMappings() to ir/validate.go
3.2	Update docs/concepts/frameworks/owasp.md
3.3	Create docs/concepts/frameworks/owasp-asi.md
3.4	Update README.md with ASI support
3.5	Add CHANGELOG entry for v0.6.0

Testing Strategy

• Unit tests for OWASPCategory enum values
• Unit tests for ASIIds field serialization
• Unit tests for all OWASP reference data entries
• Unit tests for ValidateOWASPID()
• Integration test: validate openclaw.json with new schema

Success Criteria

1. OWASPCategoryAgentic is a valid category
2. Attack steps can have asiIds field
3. All OWASP Top 10 entries have reference data
4. ValidateOWASPID() returns true for all official IDs
5. JSON schema validates files with ASI mappings
6. openclaw.json validates against new schema

References

• OWASP Top 10 for Agentic Applications (2026)
• OWASP Agentic AI Threats and Mitigations
• OWASP API Security Top 10 (2023)
• OWASP Top 10 for LLM Applications (2025)
• OWASP Web Application Top 10 (2021)