OpenMAIC
OpenMAIC 安全与运维：保护材料、Provider、会话与导出
覆盖不可信上传、SSRF、凭据、持久化会话、生成 HTML、媒体和事件响应。
你将学会
- Threat-model materials and provider boundaries
- Operate durable sessions and exports safely
- Plan redacted incident response
开始前需要
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
先看结论
- Uploads, search results, provider responses, and generated HTML are untrusted boundaries.
- Scope credentials, egress, storage, sessions, and exports independently.
- Incident response needs redacted traces, rollback, and a reproducing fixture.
Treat every material as untrusted
上传文档、音频、视频、搜索结果和模型输出都应视为不可信输入：隔离解析、限制大小与重定向、服务端保管最小权限凭据，并对 Durable Session、生成 HTML、媒体导出和日志实施留存、脱敏、清理与回滚策略。
The README advertises web search, multimedia extraction, and OpenClaw messaging integrations. Each expands the input boundary; allow-list domains, validate redirects, enforce timeouts, and log a redacted request ID so an operator can investigate without retaining sensitive course material.
Constrain providers and generated tools
Keep model, image, TTS, ASR, search, and storage credentials server-side and scoped to the capability that needs them. Separate provider selection from user-controlled text, reject unexpected endpoints, and make retries bounded. If a provider falls back, record the change because it can alter data residency, cost, and lesson quality.
Generated slides, interactive HTML, scripts, and media are outputs that need a sandbox. Escape HTML, block dangerous URLs and executable attachments, and serve downloads with safe content types. Never interpret generated course content as trusted application configuration.
Operate durable sessions safely
Durable sessions make cancellation, resume, and restart useful, but they also retain materials, prompts, artifacts, and possibly provider responses. Define retention and deletion policies, encrypt storage, isolate tenant/session identifiers, and redact logs. Test duplicate resume, stale cancellation, abandoned uploads, and partial export cleanup.
For operators, monitor authentication failures, provider errors, outbound destinations, queue depth, storage growth, and unusual tool or export activity. A health check should distinguish the UI, database, model route, and media services so an incident does not trigger indiscriminate key rotation.
Prepare incident response and review
Keep a rollback commit, known-good provider configuration, and a clean export path. On suspected prompt injection or data leakage, stop the affected capability, preserve redacted traces and hashes, revoke only the exposed credential, and notify the owner of the material. Then add a fixture that reproduces the boundary failure.
Generated educational content also needs human governance: a qualified reviewer checks factual accuracy, accessibility, copyright, and audience suitability before publication or classroom use. Security controls protect the pipeline; they do not certify the lesson itself.
如何选择
| 比较维度 | 方案 A | 方案 B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
实施步骤
- 1
Sandbox parsing and cap material size, redirects, and runtime.
- 2
Keep scoped provider credentials server-side and validate endpoints.
- 3
Encrypt and isolate durable sessions with retention and cleanup tests.
- 4
Monitor boundaries, rehearse rollback, and require human lesson review.
可复制示例
openmaic_security:
uploads: sandboxed
outbound_domains: [<allow-listed>]
provider_keys: server_only
session_retention_days: <policy>
generated_html: sanitized
logs: redacted常见问题
Can a trusted document be passed directly to the agent?
No. Treat all uploaded or fetched material as untrusted, isolate parsing, and preserve a reviewable source boundary.
What should be revoked after an incident?
Revoke the credential or capability actually exposed, preserve redacted evidence, and avoid broad destructive changes until scope is known.
资料来源
- OpenMAIC README (captured 2026-08-31)来源核查 2026-08-31
- OpenMAIC repository来源核查 2026-08-31