> ## Documentation Index
> Fetch the complete documentation index at: https://docs2.openclaw.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Collection and exfiltration (AML.TA0009, AML.TA0010)

Threats in the collection and exfiltration tactic (AML.TA0009, AML.TA0010) of the [MITRE ATLAS](https://atlas.mitre.org/) framework. Each entry lists the ATLAS technique, attack vector, affected components, current mitigations, residual risk, and recommendations.

The trust boundaries and data flows these threats cross are defined in the [threat model index](/security/THREAT-MODEL-ATLAS), which also holds the risk matrix, the recommendations summary, and the ATLAS technique mapping.

## T-EXFIL-001: Data theft via web\_fetch

| Attribute               | Value                                                                            |
| ----------------------- | -------------------------------------------------------------------------------- |
| **ATLAS ID**            | AML.T0009 - Collection                                                           |
| **Description**         | Attacker exfiltrates data by instructing the agent to send it to an external URL |
| **Attack vector**       | Prompt injection causing the agent to POST data to an attacker server            |
| **Affected components** | `web_fetch` tool                                                                 |
| **Current mitigations** | SSRF blocking for internal/private networks (DNS pinning + IP blocking)          |
| **Residual risk**       | High - arbitrary external URLs remain permitted                                  |
| **Recommendations**     | URL allowlisting, data-classification awareness                                  |

## T-EXFIL-002: Unauthorized message sending

| Attribute               | Value                                                                |
| ----------------------- | -------------------------------------------------------------------- |
| **ATLAS ID**            | AML.T0009 - Collection                                               |
| **Description**         | Attacker causes the agent to send messages containing sensitive data |
| **Attack vector**       | Prompt injection causing the agent to message the attacker           |
| **Affected components** | Message tool, channel integrations                                   |
| **Current mitigations** | Outbound messaging gating                                            |
| **Residual risk**       | Medium - gating may be bypassed                                      |
| **Recommendations**     | Explicit confirmation for new recipients                             |

## T-EXFIL-003: Credential harvesting

| Attribute               | Value                                                                                                                                                   |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **ATLAS ID**            | AML.T0009 - Collection                                                                                                                                  |
| **Description**         | Malicious skill harvests credentials from the agent context                                                                                             |
| **Attack vector**       | Skill code reads environment variables, config files                                                                                                    |
| **Affected components** | Skill execution environment                                                                                                                             |
| **Current mitigations** | ClawHub credential-pattern scanning (hardcoded secrets, credential env access paired with network sends); no execution sandboxing for skills at runtime |
| **Residual risk**       | Critical - skills run with agent privileges                                                                                                             |
| **Recommendations**     | Skill execution sandboxing, credential isolation                                                                                                        |