NemoClaw Security Gaps & Hardening Guide

Attack Mechanism

NemoClaw's intent verification engine evaluates what the agent proposes to do — not the content of data returned by external tools. If an attacker controls the output of a web page, API response, or document that the agent queries as part of a legitimate task, they can embed malicious instructions in that output. Those instructions enter the agent's reasoning chain as trusted context data, bypassing intent verification entirely.

Mitigation Strategies

• 1Treat ALL external data sources as untrusted, even from approved domains. Never pass raw external content directly into the agent context window without sanitization.
• 2Add a content-sanitization middleware layer between external tool outputs and the agent context window. Strip HTML-embedded instruction patterns before ingestion.
• 3Restrict write allowlists in your operator policy to the absolute minimum paths required. Assume any writable path is a potential exfiltration vector.
• 4Log and audit all file writes with content hashing. Alert on writes of known sensitive file patterns (private keys, credential files, .env contents).
• 5Monitor agent reasoning traces for sudden changes in behavior after external tool calls — this is a behavioral indicator of successful injection.

Hardened Policy Example

# Hardened policy for injection resistance
filesystem:
  write: 
    # Minimal write scope — only structured output directory
    - "/tmp/nemoclaw/output/reports"
  deny:
    - "~/.ssh"
    - "~/.aws"
    - "~/.config"
    - "/etc"
    - "/root"

# Add content inspection on tool outputs
content_inspection:
  external_tool_outputs:
    strip_html: true
    max_system_tokens: 0  # reject context that contains "SYSTEM:" patterns
    injection_patterns: block

Attack Mechanism

NemoClaw's security is only as strong as the operator policy file. An overly permissive YAML policy effectively disables most of the security stack. Operators who don't understand the full attack surface often write policies that are too wide — allowing entire home directories, all outbound network access, or unrestricted shell commands. This creates the illusion of security while providing minimal protection.

Mitigation Strategies

• 1Never start with a permissive policy and restrict later. Start maximally restrictive and expand permissions only when a specific need is verified.
• 2Use NVIDIA's official baseline hardened policy templates as starting points. Do not write policies from scratch until you fully understand the permission model.
• 3Validate all policies with nemoclaw policy validate before applying them. Review the validation report for any overly broad permissions.
• 4Implement a policy review process for team environments. Require a second engineer to review any policy change before it is deployed.
• 5Audit active agent sessions regularly. Use nemoclaw logs to check what file paths and network destinations are actually being accessed.

Hardened Policy Example

# Minimal secure starter policy
runtime: openShell
version: "1.0"

filesystem:
  # Explicit paths only — never use wildcards or home dir root
  read: ["/home/user/project/src", "/tmp/nemoclaw/input"]
  write: ["/tmp/nemoclaw/output"]
  deny_all_others: true

network:
  egress:
    allowlist:
      - "api.openai.com"
      # List only domains you explicitly need
    block_all_others: true  # This must always be true

shell:
  # List only exact commands needed
  allowed_commands: ["git status", "git diff", "python3"]
  deny_all_others: true

Attack Mechanism

NemoClaw's intent verification validates each proposed action in isolation. It does not track cumulative behavioral patterns across a session. An attacker who controls the agent's context can execute a policy compliance attack: individually innocuous actions that collectively achieve a malicious objective. Each step passes intent verification; the combined sequence achieves the attack.

Mitigation Strategies

• 1Implement session-level behavioral auditing. Record a summary of all actions taken in the session and periodically review against expected behavior baselines.
• 2Set session time limits and maximum action counts. Automatically prompt for human review when session duration or action count thresholds are crossed.
• 3Enable NemoClaw's behavioral fingerprinting option (experimental in alpha) to detect deviations from the initial session intent profile.
• 4Require explicit human confirmation for any agent action that modifies files that were previously read in the same session.
• 5Use the adversarial session replay tool to test your policies against known multi-turn attack sequences before live deployment.

Attack Mechanism

NemoClaw supports community-built third-party skills hosted on ClawHub — the OpenClaw skill marketplace. These skills run inside the agent sandbox but have access to the full capability envelope defined in the operator policy. A malicious or compromised skill can abuse those permissions to exfiltrate data, establish persistence, or perform lateral movement within the allowed policy scope.

Mitigation Strategies

• 1Pin all skill versions explicitly in your NemoClaw configuration. Never use "latest" tag for any skill in a security-sensitive deployment.
• 2Review the full source code of any skill before enabling it. Treat ClawHub skills with the same security scrutiny as open-source dependencies.
• 3Run skills in an additional isolation layer with a more restrictive sub-policy than the main agent session when possible.
• 4Subscribe to ClawHub security advisories. Monitor pinned skill versions for newly published vulnerability disclosures.
• 5Consider maintaining an internal vetted skill registry; only allow skills that have passed internal security review.

Hardened Policy Example

# Lock skill versions in nemoclaw config
skills:
  - name: "code-reviewer"
    source: "clawhub"
    version: "1.2.3"  # Never use "latest" — always pin exact version
    checksum: "sha256:abc123..."  # Verify integrity
    sub_policy:  # Skills get their own restricted policy
      filesystem:
        read: ["/tmp/nemoclaw/input"]
        write: []
      network:
        egress:
          allowlist: []  # No network for this skill
          block_all_others: true