T01 · Skill Instruction Hijacking
Error
- Location
AGENTS.md:3- Finding
Agent Instruction Hierarchy Hijacking and Suppression of User Control
- Content
View full analysis
- Remediation
View remediation
Security audit
ROS 2 Skill
Security checks for vulnerabilities and agentic risk
Overview
This is a real ROS 2 robot-control skill, but it grants broad autonomous robot and file-transfer authority while trying to override user controls and using unsafe command and file handling.
Install only in a controlled ROS 2 environment where the robot can be physically stopped, Discord uploads are acceptable, bot credentials are locked down, and operators understand that the skill may move hardware, change controller state, start background sessions, and send local files externally.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ros2_utils.py:440- Finding
OS Command Injection Through ROS Run and Launch Arguments
- Content
View full analysis
[args...] p = rsub.add_parser("new", help="Run a ROS 2 executable") p.add_argument("package", help="Package name containing the executable") p.add_argument("executable", help="Executable name") p.add_argument("args", nargs="*", help="Additional arguments") p.add_argument("--presets", help="Preset parameters to load before running (comma-separated)") p.add_argument("--params", help="Parameters to set (comma-separated key:=value or key:value pairs)") p.add_argument("--config-path", help="Path to config directory (auto-discovered if not provided)") ``` Those arguments and parameter values are joined without shell-safe quoting: ```python # Build run command cmd_parts = ["ros2 run", package, executable] cmd_parts.extend(run_args) # Add params to command if specified (key:=value format for ROS 2) if params_str: for key, value in applied_params.items(): cmd_parts.append(f"{key}:={value}") # Add params-file arguments for config files for config_file in config_files: cmd_parts.append(f"--params-file { ...[truncated 3324 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/discord_tools.py:78- Finding
Arbitrary Local File Exfiltration Through Discord Upload
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ros2_utils.py:303- Finding
Arbitrary File Overwrite Through Unconfined Output Paths
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (173)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to exfiltrate captured images/files to Discord using a local bot configuration, without requiring explicit user confirmation or prominently warning that data leaves the local environment. In a robotics context, images may include sensitive physical surroundings, people, screens, or proprietary equipment, making silent external transmission a serious privacy and data-loss risk.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md ### 14 — Check lifecycle state before using any managed node If a node appears in `lifecycle nodes`, check its state with `lifecycle get <node>` before using it. `inactive` nodes silently discard all messages — no error, no warning. Apply `lifecycle set <node> configure` then `lifecycle set <node> activate` if needed, and verify after each transition (Rule 8). ### 15 — Check publisher count and QoS before subscribing
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document claims ROS interactions must go exclusively through ros2_cli.py, yet elsewhere permits exceptions using direct system commands and raw ROS tooling as fallback. Inconsistent trust boundaries are dangerous because they normalize bypassing the structured wrapper, undermining safety checks, output validation, and policy enforcement.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
The instruction to 'skip silently' and 'do not warn the user' suppresses relevant safety context about the absence of proximity sensors before longer motions. While not a classic anti-refusal jailbreak, it does direct the agent to withhold materially relevant operational information that could affect user risk decisions.
- Content
md - **No sensor found** → skip silently. Do not warn the user. Proceed with motion.
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding similarly suggests the package includes substantial testing and validation infrastructure not reflected in the skill description. Undeclared scaffolding increases review complexity and may conceal extra filesystem or subprocess behaviors even if the intent is not malicious.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction to use this skill for 'ANY ROS 2 robot task' and 'when in doubt, use this skill' is overbroad routing guidance. In an agent ecosystem, this can cause excessive invocation of a highly privileged robot-control skill, increasing the chance of unsafe or destructive actions being selected by default.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises direct robot control but lacks a prominent user warning about potentially destructive physical operations. In robotics, absence of clear safety warnings materially increases risk because users and agents may treat movement, lifecycle, controller, or service actions as routine when they can affect hardware and people.
- Content
Static analysis
No suspicious patterns detected.