执行是新的攻击面：面向OpenClaw风格的生存意识代理加密交易
Execution Is the New Attack Surface: Survivability-Aware Agentic Crypto Trading with OpenClaw-Style Local Executors
AI总结：
本文提出SAE，一种针对OpenClaw风格系统的生存意识执行标准，通过定义执行合同和强制执行不变量，提高代理加密交易的生存能力。
摘要：
OpenClaw风格的代理堆栈将语言转化为特权执行：LLM意图通过工具拦截、策略门和本地执行器流动。同时，如skills.sh这样的技能市场使能力获取变得像安装技能和CLI一样容易，形成了不断增长的能力供应链。这些趋势将主导的安全故障模式从“错误答案”转变为执行导致的损失，其中不可信的提示、被入侵的技能或叙述操纵可能触发真实交易和不可逆的副作用。我们提出了生存意识执行（SAE），一种针对OpenClaw风格系统和技能增强代理的执行层生存标准。SAE位于策略引擎（LLM或非LLM）和交易所执行器之间。它定义了显式的执行合同（执行请求、执行环境、执行决定）并强制执行不可绕过的最后一公里不变量：基于投影的暴露预算、冷却和订单速率限制、滑点限制、分阶段执行以及工具/场所允许列表。为了使委托执行在供应链风险下可测试，我们通过记录的意图政策规范操作化委托缺口（DG），从而实现确定性的越界标签和可重复的DG指标。在使用官方Binance USD-M BTCUSDT/ETHUSDT永续合约数据（15分钟；2025年9月1日-2025年12月1日，含资金）的离线回放中，SAE提高了生存能力：MDD从0.4643降至0.0319（Full；93.1%），|CVaR_0.99|从4.025e-3缩小到约1.02e-4（~97.5%），DG损失代理从0.647降至0.019（~97.0%）。攻击成功率从1.00降至0.728，此运行中无FalseBlock。块bootstrap、配对Wilcoxon和两比例检验证实了这些变化。SAE重新定义了OpenClaw+skills时代的代理交易安全：将上游意图和技能视为不可信，并在行动成为副作用的地方强制执行生存能力。
英文摘要：
OpenClaw-style agent stacks turn language into privileged execution: LLM intents flow through tool interception, policy gates, and a local executor. In parallel, skill marketplaces such as skills.sh make capability acquisition as easy as installing skills and CLIs, creating a growing capability supply chain. Together, these trends shift the dominant safety failure mode from "wrong answers" to execution-induced loss, where untrusted prompts, compromised skills, or narrative manipulation can trigger real trades and irreversible side effects. We propose Survivability-Aware Execution (SAE), an execution-layer survivability standard for OpenClaw-style systems and skill-enabled agents. SAE sits as middleware between a strategy engine (LLM or non-LLM) and the exchange executor. It defines an explicit execution contract (ExecutionRequest, ExecutionContext, ExecutionDecision) and enforces non-bypassable last-mile invariants: projection-based exposure budgets, cooldown and order-rate limits, slippage bounds, staged execution, and tool/venue allowlists. To make delegated execution testable under supply-chain risk, we operationalize the Delegation Gap (DG) via a logged Intended Policy Spec that enables deterministic out-of-scope labeling and reproducible DG metrics. On an offline replay using official Binance USD-M BTCUSDT/ETHUSDT perpetual data (15m; 2025-09-01--2025-12-01, incl. funding), SAE improves survivability: MDD drops from 0.4643 to 0.0319 (Full; 93.1%), |CVaR_0.99| shrinks from 4.025e-3 to ~1.02e-4 (~97.5%), and DG loss proxy falls from 0.647 to 0.019 (~97.0%). AttackSuccess decreases from 1.00 to 0.728 with zero FalseBlock in this run. Block bootstrap, paired Wilcoxon, and two-proportion tests confirm the shifts. SAE reframes agentic trading safety for the OpenClaw+skills era: treat upstream intent and skills as untrusted, and enforce survivability where actions become side effects.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
