Venus BLE Vibrator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:18 AM UTC
• Version: 1.1.0

Overview

This skill clearly does what it says, but it controls an intimate physical device through an unauthenticated local bridge and relies on mutable external setup code.

Install only if you understand that OpenClaw may directly activate the connected vibrator. Use it only with the informed consent of the person using the device, keep the stop command available, run the bridge locally with restricted network exposure, and prefer a pinned or reviewed bridge version before running external setup code.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20
• Finding: Execution of an Unpinned External Bridge Dependency< — complete Steps 1–3 (discover device ID, configure, verify locally), then start the server: ```bash uv run 4-bridge/server.py ``` ``` ### Technical Analysis The skill directs users to obtain setup instructions and executable bridge code from a mutable personal GitHub repository. It then instructs them to execute `4-bridge/server.py` without identifying a reviewed commit, signed release, checksum, or other integrity constraint. Consequently, the effective local executable is not fully represented by the audited skill package and can change after this skill has been reviewed. The external repository was not included in the supplied project, so its current content cannot be classified as malicious based on this audit. The vulnerability is the absence of dependency pinning and integrity verification, not evidence that the referenced repository is presently compromised. ### Attack Path 1. An attacker compromises the upstream repository, its maintainer account, or the distribution path used to access it. 2. The attacker modifies the setup instructions or `4-bridge/server.py`. 3. A user follows the link in `SKILL.md` and obtains the altered upstream content. 4. The user runs `uv run 4-bridge/server.py` as instructed. 5. The substituted code executes with the user's local account privileges and any Bluetooth, filesystem, or network permissions granted to the process. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user running the bridge. The resulting scope could include access to files available to that account, outbound network connectivity, and granted macOS Bluetooth permissions. Additional impact would depend on the ...[truncated 90 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the external bridge to a specific reviewed Git commit or immutable, versioned release. - Publish and verify a cryptographic checksum for every downloaded executable file. - Prefer signed releases and document how users must verify the signature before execution. - Vendor the reviewed bridge implementation into the project where licensing and maintenance requirements permit. - Document the exact expected files and dependency versions instead of relying on mutable upstream setup instructions. - Run the bridge with the minimum required operating-system permissions and avoid executing it from an administrator account. - Establish a process for reviewing and deliberately updating the pinned version rather than automatically following upstream changes. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31
• Finding: Unauthenticated Plaintext HTTP Interface for Physical Device Control<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 31–46 **Vulnerability Type**: Unauthenticated plaintext actuator-control endpoint **Risk Level**: Medium ### Vulnerable Code ```markdown ### Vibrate at intensity ```bash curl -s -X POST http://host.docker.internal:8888/vibrate \ -H "Content-Type: application/json" \ -d '{"intensity": 60}' ``` `intensity`: 0–100 (0 = stop) ### Stop immediately ```bash curl -s -X POST http://host.docker.internal:8888/stop ``` ### Check status ```bash curl -s http://host.docker.internal:8888/status ``` ``` ### Technical Analysis The documented interface sends physical-device commands over plaintext HTTP and does not include an authentication token, request signature, or server identity verification. Any process able to reach an accepting service on port `8888` could therefore attempt to issue the same requests. The use of a fixed host and port also creates a service-spoofing risk. If an unintended process controls that endpoint, the agent may send requests to it because no application-level server identity is checked. Conversely, if the bridge listens beyond a properly isolated loopback interface, another reachable process or host may be able to submit vibration commands. The bridge implementation is absent from the audited project, so its actual bind address, network controls, and undocumented authentication behavior could not be verified. The finding is based on the explicitly documented request protocol, which contains no authentication and uses unencrypted HTTP. ### Attack Path 1. The legitimate bridge is started on port `8888`, or an attacker-controlled process occupies that port first. 2. The endpoint is reachable from an untrusted local process, container, or network host due to its binding and network configuration. 3. The attacker sends an unauthenticated request such as `POST /vibrate` with an attacker-selected intensity. 4. If the legitimate bridge accepts the request, it forwards t ...[truncated 966 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Bind the bridge exclusively to an appropriate loopback interface or a private Unix-domain socket; do not listen on all network interfaces. - Require a cryptographically random, per-installation bearer token for every control and status request. - Store the token with restrictive filesystem permissions and avoid exposing it in logs or process listings. - Authenticate the server before sending actuator commands, such as through a challenge-response mechanism or mutually authenticated local IPC. - If traffic can cross a host or network trust boundary, use authenticated TLS rather than plaintext HTTP. - Reject cross-origin browser requests and validate the `Host` header where applicable. - Apply firewall and container-network rules so only the intended OpenClaw process or container can reach the bridge. - Validate request methods, content types, payload schemas, and intensity bounds on the server. - Add rate limits, maximum session durations, automatic stop behavior, and an independently accessible emergency-stop control. - Verify the bridge identity through a dedicated authenticated health endpoint before issuing physical-device commands. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This skill directly controls an intimate physical device and can trigger immediate real-world actuation, but it does not provide an explicit safety warning, consent boundary, or clear notice about the physical nature of the action. In this context, omission is security-relevant because a user may invoke commands without understanding that the agent can cause instant bodily effects, increasing the risk of non-consensual activation, surprise actuation, or unsafe use.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Vibrate at intensity

```bash
curl -s -X POST http://host.docker.internal:8888/vibrate \
  -H "Content-Type: application/json" \
  -d '{"intensity": 60}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.