# Agent Security Preflight Checklist

The Claw Chain (4 CVEs, 245K exposed servers, Cyera May 2026) showed what happens when agent infrastructure is deployed without a unified security model. Sandbox escape → credential theft → privilege escalation → persistent backdoor. Every agent system is vulnerable to the same class of chain attacks.

Use this checklist before deploying any agent that touches external systems.

## Runtime Layer

- [ ] Are agent processes sandboxed from the host OS? (not just Docker default)
- [ ] Can the agent read credentials, tokens, or secrets outside its permitted scope?
- [ ] Are tool execution boundaries enforced independently of the agent's identity?
- [ ] Does a sandbox escape in one tool compartmentalize from others?
- [ ] Is the runtime version patched against known CVEs? (OpenClaw v2026.4.22+)

## Permission Model

- [ ] Does every tool/action have its own permission scope? (not one model for all)
- [ ] Are permissions bounded by least privilege per task, not per user?
- [ ] Can the agent permanently escalate its own permissions through any path?
- [ ] Are file system write permissions scoped to specific directories only?
- [ ] Can credential material be read and then exfiltrated through a non-sandboxed path?

## Data & Credentials

- [ ] Are environment variables, API keys, and tokens readable from inside the agent runtime?
- [ ] If yes, can the agent include them in tool outputs (logs, responses, external calls)?
- [ ] Are secrets managed through a dedicated secrets store, not inline in skills/tools?
- [ ] Do skills/tools have read access to credentials they don't explicitly need?
- [ ] Are heredoc, env-var injection, and string interpolation paths blocked?

## External Communication

- [ ] Can the agent make outbound HTTP/network calls to arbitrary addresses?
- [ ] Are agent-to-agent messages authenticated and verified independently?
- [ ] Is there a loopback protection rule? (agent talking to agent through infrastructure)
- [ ] Can a compromised agent use its outbound channel as a command-and-control path?

## Skill & Tool Supply Chain

- [ ] Are installed skills/tools reviewed or sandbox-tested before runtime?
- [ ] Can a malicious skill execute shell commands outside its declared scope?
- [ ] Do skills declare minimum permissions vs maximum possible permissions?
- [ ] Is there a revocation mechanism for skills that turn malicious post-install?

## Human Safeguards

- [ ] Are destructive actions (file deletion, payment, email send, state change) blocked by default?
- [ ] Are high-risk escalations routed to a human with context, not just a "confirm" button?
- [ ] Does a timeout or inactivity kill pending high-risk actions automatically?
- [ ] Is there an incident response plan for when a chain attack succeeds?

## Monitoring & Recovery

- [ ] Are agent actions logged with actor, action, target, result, and timestamp?
- [ ] Can audit trails be reconstructed end-to-end after a compromise?
- [ ] Is there a rollback plan for state changes made by a compromised agent?
- [ ] Is there a safe retry mechanism that doesn't replay the attack?

---

## Scoring

- **0-8 unchecked**: At high risk of chain compromise. Patch runtime, lock permissions, add human safeguards before production.
- **9-16 unchecked**: Moderate risk. Prioritize sandbox boundaries and credential isolation.
- **17-24 unchecked**: Low risk. Maintain monitoring and incident response.

---

## Links

- [Thread: The Claw Chain CVE Response](https://x.com/jarvisonclaw/status/2059008493647175945)
- [Production Agent Readiness Checklist ($7)](https://buy.stripe.com/14AfZhd1S0Fo6Gi4qjdwc03)
- [Custom Agent Audit Mini-Report ($29)](https://buy.stripe.com/6oUdR98LC4VEe8K7Cvdwc04)