Fased Threat Model v1.0

MITRE ATLAS Framework

Version: 1.0-draft Last Updated: 2026-05-20 Methodology: MITRE ATLAS + Data Flow Diagrams Framework: MITRE ATLAS (Adversarial Threat Landscape for AI Systems)

Framework Attribution

This threat model is built on MITRE ATLAS, the industry-standard framework for documenting adversarial threats to AI/ML systems. ATLAS is maintained by MITRE in collaboration with the AI security community. Key ATLAS Resources:

Contributing to This Threat Model

This is a living document maintained by the Fased contributor community. See Contributing to the threat model for guidelines on contributing:

Reporting new threats
Updating existing threats
Proposing attack chains
Suggesting mitigations

1. Introduction

1.1 Purpose

This threat model documents adversarial threats to the Fased agent/runtime platform and plugin catalog, using the MITRE ATLAS framework designed specifically for AI/ML systems.

1.2 Scope

Component	Included	Notes
Fased Runtime	Yes	Core agent execution, tool calls, sessions
Gateway	Yes	Authentication, routing, channel integration
Channel Integrations	Yes	WhatsApp, Telegram, Discord, Signal, Slack, etc.
Plugin Catalog	Yes	Public registry contract plus Fased review/install client
Wallet Runtime	Yes	Wallet roles, passkey approvals, skill grants
MCP Servers	Yes	External tool providers
User Devices	Partial	Mobile apps, desktop clients and Advanced > Nodes diagnostics

1.3 Coverage Limits

No major Fased runtime surface is intentionally excluded. Coverage depth still varies by area: third-party services, cloud providers, wallets, chains, and model providers are covered at the Fased integration boundary, not as complete audits of those external systems.

2. System Architecture

2.1 Trust Boundaries

┌─────────────────────────────────────────────────────────────────┐
│                    UNTRUSTED ZONE                                │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐              │
│  │  WhatsApp   │  │  Telegram   │  │   Discord   │  ...         │
│  └──────┬──────┘  └──────┬──────┘  └──────┬──────┘              │
│         │                │                │                      │
└─────────┼────────────────┼────────────────┼──────────────────────┘
          │                │                │
          ▼                ▼                ▼
┌─────────────────────────────────────────────────────────────────┐
│                 TRUST BOUNDARY 1: Channel Access                 │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │                      GATEWAY                              │   │
│  │  • Device Pairing (30s grace period)                      │   │
│  │  • AllowFrom / AllowList validation                       │   │
│  │  • Token/Password/Tailscale auth                          │   │
│  └──────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│                 TRUST BOUNDARY 2: Session Isolation              │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │                   AGENT SESSIONS                          │   │
│  │  • Session key = agent:channel:peer                       │   │
│  │  • Tool policies per agent                                │   │
│  │  • Agent-scoped skill allowlists                          │   │
│  │  • Transcript logging                                     │   │
│  └──────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│                 TRUST BOUNDARY 3: Tool Execution                 │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │                  EXECUTION SANDBOX                        │   │
│  │  • Docker sandbox OR Host (exec-approvals)                │   │
│  │  • Agent > Tools allow/deny policy                        │   │
│  │  • Node remote execution                                  │   │
│  │  • SSRF protection (DNS pinning + IP blocking)            │   │
│  └──────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│                 TRUST BOUNDARY 4: External Content               │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │              FETCHED URLs / EMAILS / WEBHOOKS             │   │
│  │  • External content wrapping (XML tags)                   │   │
│  │  • Security notice injection                              │   │
│  └──────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│                 TRUST BOUNDARY 5: Supply Chain                   │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │                  PLUGIN CATALOG                           │   │
│  │  • Skill publishing (semver, SKILL.md required)           │   │
│  │  • Pattern-based moderation flags                         │   │
│  │  • Review before install                                  │   │
│  │  • Dependency install remains separate from Agent access   │   │
│  └──────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│                 TRUST BOUNDARY 6: Wallet Authority               │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │                      WALLETS                              │   │
│  │  • Role-separated wallets (agent/mining/vault)            │   │
│  │  • Passkey approvals and caps                             │   │
│  │  • Wallet > Skill Grants for reviewed skills only         │   │
│  │  • Mining wallet reserved for SAT mining runtime          │   │
│  └──────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

2.2 Data Flows

Flow	Source	Destination	Data	Protection
F1	Channel	Gateway	User messages	TLS, AllowFrom
F2	Gateway	Agent	Routed messages	Session isolation
F3	Agent	Tools	Tool invocations	Policy enforcement
F4	Agent	External	web_fetch requests	SSRF blocking
F5	Catalog	Agent	Skill files	Review, moderation, path checks
F6	Agent	Channel	Responses	Output filtering
F7	Agent	Wallet	Wallet actions	Role policy, caps, approval gates, skill grants

3. Threat Analysis by ATLAS Tactic

3.1 Reconnaissance (AML.TA0002)

T-RECON-001: Agent Endpoint Discovery

Attribute	Value
ATLAS ID	AML.T0006 - Active Scanning
Description	Attacker scans for exposed Fased gateway endpoints
Attack Vector	Network scanning, shodan queries, DNS enumeration
Affected Components	Gateway, exposed API endpoints
Current Mitigations	Tailscale auth option, bind to loopback by default
Residual Risk	Medium - Public gateways discoverable
Recommendations	Document secure deployment, add rate limiting on discovery endpoints

T-RECON-002: Channel Integration Probing

Attribute	Value
ATLAS ID	AML.T0006 - Active Scanning
Description	Attacker probes messaging channels to identify AI-managed accounts
Attack Vector	Sending test messages, observing response patterns
Affected Components	All channel integrations
Current Mitigations	None specific
Residual Risk	Low - Limited value from discovery alone
Recommendations	Consider response timing randomization

3.2 Initial Access (AML.TA0004)

T-ACCESS-001: Pairing Code Interception

Attribute	Value
ATLAS ID	AML.T0040 - AI Model Inference API Access
Description	Attacker intercepts pairing code during 30s grace period
Attack Vector	Shoulder surfing, network sniffing, social engineering
Affected Components	Device pairing system
Current Mitigations	30s expiry, codes sent via existing channel
Residual Risk	Medium - Grace period exploitable
Recommendations	Reduce grace period, add confirmation step

T-ACCESS-002: AllowFrom Spoofing

Attribute	Value
ATLAS ID	AML.T0040 - AI Model Inference API Access
Description	Attacker spoofs allowed sender identity in channel
Attack Vector	Depends on channel - phone number spoofing, username impersonation
Affected Components	AllowFrom validation per channel
Current Mitigations	Channel-specific identity verification
Residual Risk	Medium - Some channels vulnerable to spoofing
Recommendations	Document channel-specific risks, add cryptographic verification where possible

T-ACCESS-003: Token Theft

Attribute	Value
ATLAS ID	AML.T0040 - AI Model Inference API Access
Description	Attacker steals authentication tokens from config files
Attack Vector	Malware, unauthorized device access, config backup exposure
Affected Components	~/.fased/credentials/, config storage
Current Mitigations	File permissions
Residual Risk	High - Tokens stored in plaintext
Recommendations	Implement token encryption at rest, add token rotation

3.3 Execution (AML.TA0005)

T-EXEC-001: Direct Prompt Injection

Attribute	Value
ATLAS ID	AML.T0051.000 - LLM Prompt Injection: Direct
Description	Attacker sends crafted prompts to manipulate agent behavior
Attack Vector	Channel messages containing adversarial instructions
Affected Components	Agent LLM, all input surfaces
Current Mitigations	Pattern detection, external content wrapping
Residual Risk	Critical - Detection only, no blocking; sophisticated attacks bypass
Recommendations	Implement multi-layer defense, output validation, user confirmation for sensitive actions

T-EXEC-002: Indirect Prompt Injection

Attribute	Value
ATLAS ID	AML.T0051.001 - LLM Prompt Injection: Indirect
Description	Attacker embeds malicious instructions in fetched content
Attack Vector	Malicious URLs, poisoned emails, compromised webhooks
Affected Components	web_fetch, email ingestion, external data sources
Current Mitigations	Content wrapping with XML tags and security notice
Residual Risk	High - LLM may ignore wrapper instructions
Recommendations	Implement content sanitization, separate execution contexts

T-EXEC-003: Tool Argument Injection

Attribute	Value
ATLAS ID	AML.T0051.000 - LLM Prompt Injection: Direct
Description	Attacker manipulates tool arguments through prompt injection
Attack Vector	Crafted prompts that influence tool parameter values
Affected Components	All tool invocations
Current Mitigations	Exec approvals for dangerous commands
Residual Risk	High - Relies on user judgment
Recommendations	Implement argument validation, parameterized tool calls

T-EXEC-004: Exec Approval Bypass

Attribute	Value
ATLAS ID	AML.T0043 - Craft Adversarial Data
Description	Attacker crafts commands that bypass approval allowlist
Attack Vector	Command obfuscation, alias exploitation, path manipulation
Affected Components	exec-approvals.ts, command allowlist
Current Mitigations	Allowlist + ask mode
Residual Risk	High - No command sanitization
Recommendations	Implement command normalization, expand blocklist

3.4 Persistence (AML.TA0006)

T-PERSIST-001: Malicious Skill Installation

Attribute	Value
ATLAS ID	AML.T0010.001 - Supply Chain Compromise: AI Software
Description	Attacker publishes malicious skill to the plugin catalog
Attack Vector	Create account, publish skill with hidden malicious code
Affected Components	Plugin catalog, skill loading, agent execution
Current Mitigations	Registry moderation where available, Fased install review, path/layout checks, required `SKILL.md`, Agent allowlist separate from install
Residual Risk	High - Skills can still steer tool use and dependency installers may introduce supply-chain risk
Recommendations	Package integrity/pinning, stronger external package trust warnings, skill sandboxing, community review

T-PERSIST-002: Skill Update Poisoning

Attribute	Value
ATLAS ID	AML.T0010.001 - Supply Chain Compromise: AI Software
Description	Attacker compromises popular skill and pushes malicious update
Attack Vector	Account compromise, social engineering of skill owner
Affected Components	Plugin catalog versioning, auto-update flows
Current Mitigations	Version fingerprinting, update-risk review before replacing installed content
Residual Risk	Medium - Updates can still add dangerous instructions or dependencies
Recommendations	Implement update signing, rollback capability, version pinning

T-PERSIST-003: Agent Configuration Tampering

Attribute	Value
ATLAS ID	AML.T0010.002 - Supply Chain Compromise: Data
Description	Attacker modifies agent configuration to persist access
Attack Vector	Config file modification, settings injection
Affected Components	Agent config, tool policies
Current Mitigations	File permissions
Residual Risk	Medium - Requires local access
Recommendations	Config integrity verification, audit logging for config changes

3.5 Defense Evasion (AML.TA0007)

T-EVADE-001: Moderation Pattern Bypass

Attribute	Value
ATLAS ID	AML.T0043 - Craft Adversarial Data
Description	Attacker crafts skill content to evade moderation patterns
Attack Vector	Unicode homoglyphs, encoding tricks, dynamic loading
Affected Components	Plugin registry moderation and Fased skill/archive scanner
Current Mitigations	Registry moderation plus Fased archive and permission review
Residual Risk	High - Simple regex easily bypassed
Recommendations	Add behavioral analysis (VirusTotal Code Insight), AST-based detection

T-EVADE-002: Content Wrapper Escape

Attribute	Value
ATLAS ID	AML.T0043 - Craft Adversarial Data
Description	Attacker crafts content that escapes XML wrapper context
Attack Vector	Tag manipulation, context confusion, instruction override
Affected Components	External content wrapping
Current Mitigations	XML tags + security notice
Residual Risk	Medium - Novel escapes discovered regularly
Recommendations	Multiple wrapper layers, output-side validation

3.6 Discovery (AML.TA0008)

T-DISC-001: Tool Enumeration

Attribute	Value
ATLAS ID	AML.T0040 - AI Model Inference API Access
Description	Attacker enumerates available tools through prompting
Attack Vector	”What tools do you have?” style queries
Affected Components	Agent tool registry
Current Mitigations	None specific
Residual Risk	Low - Tools generally documented
Recommendations	Consider tool visibility controls

T-DISC-002: Session Data Extraction

Attribute	Value
ATLAS ID	AML.T0040 - AI Model Inference API Access
Description	Attacker extracts sensitive data from session context
Attack Vector	”What did we discuss?” queries, context probing
Affected Components	Session transcripts, context window
Current Mitigations	Session isolation per sender
Residual Risk	Medium - Within-session data accessible
Recommendations	Implement sensitive data redaction in context

3.7 Collection & Exfiltration (AML.TA0009, AML.TA0010)

T-EXFIL-001: Data Theft via web_fetch

Attribute	Value
ATLAS ID	AML.T0009 - Collection
Description	Attacker exfiltrates data by instructing agent to send to external URL
Attack Vector	Prompt injection causing agent to POST data to attacker server
Affected Components	web_fetch tool
Current Mitigations	SSRF blocking for internal networks
Residual Risk	High - External URLs permitted
Recommendations	Implement URL allowlisting, data classification awareness

T-EXFIL-002: Unauthorized Message Sending

Attribute	Value
ATLAS ID	AML.T0009 - Collection
Description	Attacker causes agent to send messages containing sensitive data
Attack Vector	Prompt injection causing agent to message attacker
Affected Components	Message tool, channel integrations
Current Mitigations	Outbound messaging gating
Residual Risk	Medium - Gating may be bypassed
Recommendations	Require explicit confirmation for new recipients

T-EXFIL-003: Credential Harvesting

Attribute	Value
ATLAS ID	AML.T0009 - Collection
Description	Malicious skill harvests credentials from agent context
Attack Vector	Skill code reads environment variables, config files
Affected Components	Skill execution environment
Current Mitigations	Skill install/config is separate from Agent access; service credentials belong in Services/skill config; wallet and mining grants are separate
Residual Risk	High - A malicious allowed skill can still influence the Agent to reveal or misuse available context/tools
Recommendations	Skill sandboxing, credential isolation, stronger secret redaction and review warnings

3.8 Impact (AML.TA0011)

T-IMPACT-001: Unauthorized Command Execution

Attribute	Value
ATLAS ID	AML.T0031 - Erode AI Model Integrity
Description	Attacker executes arbitrary commands on user system
Attack Vector	Prompt injection combined with exec approval bypass
Affected Components	Bash tool, command execution
Current Mitigations	Exec approvals, Docker sandbox option
Residual Risk	Critical - Host execution without sandbox
Recommendations	Default to sandbox, improve approval UX

T-IMPACT-002: Resource Exhaustion (DoS)

Attribute	Value
ATLAS ID	AML.T0031 - Erode AI Model Integrity
Description	Attacker exhausts API credits or compute resources
Attack Vector	Automated message flooding, expensive tool calls
Affected Components	Gateway, agent sessions, API provider
Current Mitigations	Gateway auth rate limits, task run budgets, provider cooldown/failover, and channel/provider backoff where implemented
Residual Risk	High - public or high-volume channels can still exhaust account/API/provider resources if policy is too loose
Recommendations	Expand per-sender limits, cost budgets, and operator alerts for public/high-volume routes

T-IMPACT-003: Reputation Damage

Attribute	Value
ATLAS ID	AML.T0031 - Erode AI Model Integrity
Description	Attacker causes agent to send harmful/offensive content
Attack Vector	Prompt injection causing inappropriate responses
Affected Components	Output generation, channel messaging
Current Mitigations	LLM provider content policies
Residual Risk	Medium - Provider filters imperfect
Recommendations	Output filtering layer, user controls

T-IMPACT-004: Unauthorized Wallet Or Mining Action

Attribute	Value
ATLAS ID	AML.T0031 - Erode AI Model Integrity
Description	Attacker causes an Agent or skill to spend funds, change wallet policy, or start mining
Attack Vector	Prompt injection, malicious skill instructions, overbroad tool/wallet grants
Affected Components	Wallet runtime, SAT mining runtime, Agent tool policy, Skill Grants
Current Mitigations	Role-separated wallets, caps, passkey/approval gates, explicit Wallet > Skill Grants, mining wallet not available to generic skills
Residual Risk	High - User can still over-grant or approve a malicious action
Recommendations	Stronger policy simulation, clearer approval diffs, hardware wallet support where possible

4. Plugin Supply Chain Analysis

4.1 Current Security Controls

Fased has two different control layers:

Plugin registry controls: public publishing, search, versioning, reporting, moderation, and registry metadata.
Fased install controls: the code in this repo that reviews downloaded archives before copying skill files into an Agent workspace or shared skill library.

Control	Implementation	Effectiveness
Trusted registry origin	Fased install path records and checks the configured registry origin.	Medium - Prevents silent origin drift
Archive extraction safety	Install flow rejects traversal, symlink, oversized, VCS, dependency, and binary-style archive risks.	High - Prevents common filesystem and archive attacks
Required `SKILL.md`	`src/agents/skills-marketplace-policy.ts` rejects archives without a conventional `SKILL.md`.	Medium - Ensures the install has a reviewable skill contract
Permission inspection	`inspectSkillMarketplaceManifest()` records requested wallet, tool, and install metadata.	Medium - Makes risky asks visible before grant
Dependency trust summary	`summarizeSkillInstallTrust()` flags unpinned npm/go/uv/brew/download installers.	Medium - Shows package-manager trust and integrity gaps
Archive/content scanning	`src/security/skill-scanner.ts` and plugin artifact review surface suspicious files/patterns.	Medium - Useful guardrail, not a proof of safety
Install Review	Agent Skills / plugin review flow shows source, warnings, permissions, and dependency plan.	Medium - Makes source, warnings, and dependencies visible before install
Grant Separation	Agent Skills / Tools / Wallet Skill Grants	High - Install does not grant Agent, tool, wallet, mining, or vault access
Dependency Verification	Installer result plus requirement check	Medium - Command success is not enough; required binaries must be visible to gateway PATH
Agent-scoped skill access	Agent Skills stores allow/deny policy for the selected Agent.	High - A skill installed for one Agent is not automatically policy-approved everywhere
Wallet role restriction	Skill install policy only permits `agent` wallet role requests.	High - Generic skills cannot request mining or vault wallet roles

4.2 Moderation Flag Patterns

Registry moderation can use denylist and suspicious-pattern checks, but Fased must not rely on those checks alone. The Fased client-side review path uses archive scanning, permission extraction, install-plan review, and post-install dependency verification even when the registry says a skill is visible. Examples of suspicious patterns a registry or local scanner should treat as review pressure:

/(malware|stealer|phish|phishing|keylogger)/i
/(api[-_ ]?key|token|password|private key|secret)/i
/(wallet|seed phrase|mnemonic|crypto)/i
/(discord\.gg|webhook|hooks\.slack)/i
/(curl[^\n]+\|\s*(sh|bash))/i
/(bit\.ly|tinyurl\.com|t\.co|goo\.gl|is\.gd)/i

Limitations:

Pattern checks can miss obfuscated or indirect behavior
Text-only skill instructions can still steer an Agent toward unsafe tool use
Simple regex easily bypassed with obfuscation
No local behavioral analysis proof exists today
Dependency installers still rely on external package ecosystems unless pinned and reviewed

4.3 Planned Improvements

Improvement	Status	Impact
Package integrity/pinning UX	Recommended next hardening	High - Reduces dependency installer ambiguity
Stronger archive diff review	Recommended next hardening	Medium - Makes updates easier to audit
Community reporting sync in Fased UI	Future registry work	Medium - Brings registry trust signals into UI
Runtime sandbox for skills/tools	Future runtime work	High - Reduces blast radius after Agent approval

5. Risk Matrix

5.1 Likelihood vs Impact

Threat ID	Likelihood	Impact	Risk Level	Priority
T-EXEC-001	High	Critical	Critical	P0
T-PERSIST-001	Medium	Critical	High	P1
T-EXFIL-003	Medium	Critical	High	P1
T-IMPACT-004	Medium	Critical	High	P1
T-IMPACT-001	Medium	Critical	High	P1
T-EXEC-002	High	High	High	P1
T-EXEC-004	Medium	High	High	P1
T-ACCESS-003	Medium	High	High	P1
T-EXFIL-001	Medium	High	High	P1
T-IMPACT-002	High	Medium	High	P1
T-EVADE-001	High	Medium	Medium	P2
T-ACCESS-001	Low	High	Medium	P2
T-ACCESS-002	Low	High	Medium	P2
T-PERSIST-002	Low	High	Medium	P2

5.2 Critical Path Attack Chains

Attack Chain 1: Skill-Based Data Theft

T-PERSIST-001 → T-EVADE-001 → T-EXFIL-003
(Publish malicious skill) → (Evade moderation) → (Harvest credentials)

Attack Chain 1b: Skill-Based Wallet Abuse

T-PERSIST-001 → T-EXEC-001 → T-IMPACT-004
(Install malicious skill) → (Steer Agent behavior) → (Over-granted wallet/mining action)

Attack Chain 2: Prompt Injection to RCE

T-EXEC-001 → T-EXEC-004 → T-IMPACT-001
(Inject prompt) → (Bypass exec approval) → (Execute commands)

Attack Chain 3: Indirect Injection via Fetched Content

T-EXEC-002 → T-EXFIL-001 → External exfiltration
(Poison URL content) → (Agent fetches & follows instructions) → (Data sent to attacker)

6. Recommendations Summary

6.1 Immediate (P0)

ID	Recommendation	Addresses
R-001	Package integrity/pinning for dependency installers	T-PERSIST-001, T-PERSIST-002
R-002	Implement skill sandboxing	T-PERSIST-001, T-EXFIL-003
R-003	Add output validation for sensitive actions	T-EXEC-001, T-EXEC-002

6.2 Short-term (P1)

ID	Recommendation	Addresses
R-004	Expand rate limiting, cost budgets, and operator alerts	T-IMPACT-002
R-005	Add token encryption at rest	T-ACCESS-003
R-006	Improve exec approval UX and validation	T-EXEC-004
R-007	Implement URL allowlisting for web_fetch	T-EXFIL-001
R-011	Improve wallet approval diffs and policy simulation	T-IMPACT-004

6.3 Medium-term (P2)

ID	Recommendation	Addresses
R-008	Add cryptographic channel verification where possible	T-ACCESS-002
R-009	Implement config integrity verification	T-PERSIST-003
R-010	Add update signing and version pinning	T-PERSIST-002

7. Appendices

7.1 ATLAS Technique Mapping

ATLAS ID	Technique Name	Fased Threats
AML.T0006	Active Scanning	T-RECON-001, T-RECON-002
AML.T0009	Collection	T-EXFIL-001, T-EXFIL-002, T-EXFIL-003
AML.T0010.001	Supply Chain: AI Software	T-PERSIST-001, T-PERSIST-002
AML.T0010.002	Supply Chain: Data	T-PERSIST-003
AML.T0031	Erode AI Model Integrity	T-IMPACT-001, T-IMPACT-002, T-IMPACT-003, T-IMPACT-004
AML.T0040	AI Model Inference API Access	T-ACCESS-001, T-ACCESS-002, T-ACCESS-003, T-DISC-001, T-DISC-002
AML.T0043	Craft Adversarial Data	T-EXEC-004, T-EVADE-001, T-EVADE-002
AML.T0051.000	LLM Prompt Injection: Direct	T-EXEC-001, T-EXEC-003
AML.T0051.001	LLM Prompt Injection: Indirect	T-EXEC-002

7.2 Key Security Files

Path	Purpose	Risk Level
`src/infra/exec-approvals.ts`	Command approval logic	Critical
`src/gateway/auth.ts`	Gateway authentication	Critical
`src/web/inbound/access-control.ts`	Channel access control	Critical
`src/infra/net/ssrf.ts`	SSRF protection	Critical
`src/security/external-content.ts`	Prompt injection mitigation	Critical
`src/agents/sandbox/tool-policy.ts`	Tool policy enforcement	Critical
`src/security/skill-scanner.ts`	Skill archive scanner	High
`src/agents/skills-marketplace-policy.ts`	Skill permission inspection	High
`src/agents/skills-install-trust.ts`	Dependency trust summary	High
`src/routing/resolve-route.ts`	Session isolation	Medium
`src/wallet/`	Wallet policy and approvals	Critical
`src/mining/`	SAT mining runtime policy	Critical

7.3 Glossary

Term	Definition
ATLAS	MITRE’s Adversarial Threat Landscape for AI Systems
Plugin catalog	Fased’s reviewable skill and plugin discovery surface
Gateway	Fased’s message routing and authentication layer
MCP	Model Context Protocol - tool provider interface
Prompt Injection	Attack where malicious instructions are embedded in input
Skill	Downloadable extension for Fased agents
Skill Grant	Explicit wallet permission granted to a reviewed skill
SSRF	Server-Side Request Forgery

This threat model is a living document. For security issues, use the repository policy in SECURITY.md.

​Fased Threat Model v1.0

​MITRE ATLAS Framework

​Framework Attribution

​Contributing to This Threat Model

​1. Introduction

​1.1 Purpose

​1.2 Scope

​1.3 Coverage Limits

​2. System Architecture

​2.1 Trust Boundaries

​2.2 Data Flows

​3. Threat Analysis by ATLAS Tactic

​3.1 Reconnaissance (AML.TA0002)

​T-RECON-001: Agent Endpoint Discovery

​T-RECON-002: Channel Integration Probing

​3.2 Initial Access (AML.TA0004)

​T-ACCESS-001: Pairing Code Interception

​T-ACCESS-002: AllowFrom Spoofing

​T-ACCESS-003: Token Theft

​3.3 Execution (AML.TA0005)

​T-EXEC-001: Direct Prompt Injection

​T-EXEC-002: Indirect Prompt Injection

​T-EXEC-003: Tool Argument Injection

​T-EXEC-004: Exec Approval Bypass

​3.4 Persistence (AML.TA0006)

​T-PERSIST-001: Malicious Skill Installation

​T-PERSIST-002: Skill Update Poisoning

​T-PERSIST-003: Agent Configuration Tampering

​3.5 Defense Evasion (AML.TA0007)

​T-EVADE-001: Moderation Pattern Bypass

​T-EVADE-002: Content Wrapper Escape

​3.6 Discovery (AML.TA0008)

​T-DISC-001: Tool Enumeration

​T-DISC-002: Session Data Extraction

​3.7 Collection & Exfiltration (AML.TA0009, AML.TA0010)

​T-EXFIL-001: Data Theft via web_fetch

​T-EXFIL-002: Unauthorized Message Sending

​T-EXFIL-003: Credential Harvesting

​3.8 Impact (AML.TA0011)

​T-IMPACT-001: Unauthorized Command Execution

​T-IMPACT-002: Resource Exhaustion (DoS)

​T-IMPACT-003: Reputation Damage

​T-IMPACT-004: Unauthorized Wallet Or Mining Action

​4. Plugin Supply Chain Analysis

​4.1 Current Security Controls

​4.2 Moderation Flag Patterns

​4.3 Planned Improvements

​5. Risk Matrix

​5.1 Likelihood vs Impact

​5.2 Critical Path Attack Chains

​6. Recommendations Summary

​6.1 Immediate (P0)

​6.2 Short-term (P1)

​6.3 Medium-term (P2)

​7. Appendices

​7.1 ATLAS Technique Mapping

​7.2 Key Security Files

​7.3 Glossary