ClawHub
Back to skill

Security audit

ROS2 Control Introspection

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent ROS 2 introspection helper, with a local shell-sourcing hardening caveat but no evidence of hidden, destructive, or exfiltrating behavior.

Install only if you trust the ROS 2 environment being sourced. Review the generated config.json on unusual systems, and pass only trusted profile or --params-file inputs. Treat the wrapper as a convenience guard for read-oriented ros2 control commands, not as a complete security sandbox.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# Build the environment
    env_command = f"source {ros_setup_path} && env"
    try:
        env_proc = subprocess.run(['bash', '-c', env_command], stdout=subprocess.PIPE, text=True, check=True)
        ros_env = {}
        for line in env_proc.stdout.splitlines():
            if '=' in line:
Confidence
95% confidence
Finding
The code builds a shell command with unquoted data from config.json and executes it via `bash -c`. If `ros_setup_path` contains shell metacharacters or command substitutions, an attacker who can modify the config file can achieve arbitrary command execution before the wrapper runs the intended ROS command. The skill context claims to be a strict safety wrapper, so using a shell here is especially risky because it undermines the sandboxing/read-only trust model.

Static analysis

No suspicious patterns detected.