ClawHub
Back to skill

Security audit

ROS2 Control Execution

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly purpose-aligned, but it controls ROS 2 controller and hardware state while relying on a safety wrapper with a real command-injection weakness and broad runtime authority.

Review before installing on any real robot, lab system, or production ROS environment. Use only with a trusted ROS installation and trusted config/config.json, avoid untrusted profiles or params files, and require human approval or local guardrails for hardware-affecting commands. This is not evidence of malware, but the safety boundary is weaker than advertised.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# Build the environment
    env_command = f"source {ros_setup_path} && env"
    try:
        env_proc = subprocess.run(['bash', '-c', env_command], stdout=subprocess.PIPE, text=True, check=True)
        ros_env = {}
        for line in env_proc.stdout.splitlines():
            if '=' in line:
Confidence
94% confidence
Finding
The wrapper builds a shell command using a value loaded from config.json and executes it via `bash -c`. Because `ros_setup_path` is interpolated directly into `source {ros_setup_path} && env` without shell escaping, a malicious or tampered config value can inject arbitrary shell commands before the final ROS command even runs. In this skill context, that is especially dangerous because the script is presented as a "strict safety wrapper," so operators may trust it to safely mediate privileged ROS control actions.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The manifest says the skill supports load, switch, and unload operations, but the code also exposes `reload_controller_libraries`, `set_controller_state`, `set_hardware_component_state`, and `cleanup_controller`. This scope expansion weakens the security boundary users may rely on and can enable more disruptive or less-reviewed state changes to robot control infrastructure than the declared capability suggests.

Static analysis

No suspicious patterns detected.