Attack Surface Mapper — Defense Coverage Matrix#

Purpose#

Provide a unified view of the agent's security posture by combining offensive test results (red team) with defensive detection capabilities (blue team). Identify gaps where attacks exist but no detection covers them.

Trigger#

Run on:

• Weekly scheduled review
• After any security configuration change
• After installing/removing skills
• User request: "map attack surface", "security posture"

Attack Surface Categories#

SurfaceComponentsExample VectorsCHANNELSWhatsApp, Telegram, Discord, Slack, Signal, iMessagePrompt injection, phishing, social engineeringSKILLSAll installed SKILL.md filesMalicious instructions, conflicting directives, data theftTOOLSexec, file system, browser, networkCommand injection, path traversal, SSRFMODELSAPI endpoints (Anthropic, OpenAI, local)Prompt injection, model confusion, jailbreakMEMORY.learnings/, .memory/, session stateMemory poisoning, persistence, false contextINTER-AGENTsessions_send, shared state, cross-sessionAgent-to-agent attack, lateral movementSUPPLY CHAINClawHub skills, npm packages, model providersTyposquatting, compromised packages, model supply chain

Core Workflow#

1. Enumerate all active surfaces (channels, skills, tools, models, memory stores)

2. Load red team results from .security/red-team/*.jsonl

3. Load blue team detections from .security/audits/*.md and firewall logs

4. For each surface × vector:

   • Red tested? YES/NO
   • Blue detected? YES/NO/PARTIAL
   • Status: COVERED | PARTIAL | GAP

5. Risk score each gap: impact(1-5) × likelihood(1-5)

6. Generate coverage matrix and prioritized hardening plan

7. Output to .security/surface-map-YYYY-MM-DD.md

Coverage Matrix (example output)#

SurfaceVectorRed TestedBlue DetectedStatusRisk ScorePriorityChannelPrompt injectionYESYESCOVERED——ChannelEncoded payloadYESPARTIALPARTIAL12HIGHSkillMalicious SKILL.mdNONOGAP20CRITICALMemoryPoisoningYESNOGAP16HIGHSupply chainTyposquattingNONOGAP15HIGH

Guardrails#

• Read-only aggregation — never modifies defenses directly
• Gap data is confidential — stored in .security/ only
• Recommendations are advisory — require human approval to implement
• Re-run after every hardening cycle to measure improvement