Security
This section is core’s own security account of PersonalClaw: a threat model that names the trust boundaries the system is designed around, and a written list of what it does not enforce yet. Read both — the second is the shorter one and the one that will change how you configure it.
The threat model works through the boundaries in turn — owner to agent to tools, core to apps, the gateway to inbound channels, the install pipeline to its sources, and the system to persisted or exported state — and maps them against the OWASP Agentic Security Top-10. It closes with what PersonalClaw deliberately does not defend against, which is a design position rather than a backlog.
Limitations is the honest half. It lists controls that are declared but not yet enforced, each with what an attacker or a careless prompt could do as a result, and it explains why they are published rather than quietly fixed later. If you are deciding how much autonomy to grant on a machine that matters, that page is the one to read first.
Neither document is a guarantee, and this project is pre-1.0. The marketing site’s security page summarises the same posture for a reader who has not installed anything yet; these two are the source it summarises.
Both pages are core’s text, published from the release this site was built from — see release provenance for which one, because a limitation fixed after that release is still listed here. Corrections land in core, not here.
The documents
Section titled “The documents”- Security Limitations — What We Do Not (Yet) Enforce — PersonalClaw’s strongest claim is that its controls are enforced at the point of execution, not merely requested in a prompt.
- External Review Scope — Five High-Risk Paths — The threat model claims that PersonalClaw’s controls are enforced at chokepoints rather than requested in a prompt, and cites a module for every “enforced” row.
- Scanner Testing — the Published Adversarial Corpus — The threat model claims that community content is gated at one chokepoint before it can reach the live skills tree.
- Artifact signing — How PersonalClaw decides whether an app bundle is from who it says it is, and what that buys.
- PersonalClaw Threat Model — PersonalClaw runs an autonomous agent on the owner’s own machine.