ClawHub
Back to skill

Security audit

Vector-Robot

Security checks across malware telemetry and agentic risk

Overview

This Vector robot skill is mostly purpose-aligned, but it needs Review because it combines physical robot/camera control with an unsafe helper script, an unauthenticated proxy, local prompt logging, and optional macOS persistence.

Review before installing. Patch the speech helper before passing untrusted text, avoid the LaunchAgent unless you intentionally want an always-on proxy, bind the proxy to localhost with authentication, and treat request.json, response.json, proxy logs, and camera snapshots as private data. Supervise robot movement because behavior control disables cliff sensors.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill documents shell commands, local network access, and environment-variable use, but no permissions are declared. That creates a transparency and policy gap: an agent could invoke capabilities with security implications, including local service access and robot control, without an explicit permission boundary or user review. In this context the missing declaration is more concerning because the skill can move a physical device and access its camera.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The stated purpose is robot control, but the skill also introduces additional behaviors: a local proxy server, file-based request/response IPC, and a persistent LaunchAgent. These expand the attack surface beyond the declared function, enable background operation, and could be abused to intercept or inject prompts/commands through the local bridge. The mismatch makes the skill materially more dangerous because users may consent to robot actions without realizing they are also installing a persistent local service.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The reference exposes `/api/get_config` and `/api/get_logs`, which go beyond core robot actuation and can reveal sensitive local configuration details and recent voice-command history. In the context of a robot-control skill, documenting and potentially enabling access to these endpoints expands the attack surface into privacy-sensitive and operational data without a clear need.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The API documents behavior control that disables cliff sensors, meaning the robot can be driven in a state with reduced physical safety protections. In a skill intended to control a physical robot, insufficient safety framing and lack of operational guardrails can lead to falls, collisions, or unsafe motion in the user's environment.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The camera stream and voice-command log endpoints expose privacy-sensitive data from the robot's environment and user interactions, yet the reference provides no warning, consent model, or access restrictions. Because this skill is specifically for remote robot interaction, these capabilities are more dangerous here: they can enable surveillance of surroundings and collection of spoken-command history.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script creates a macOS LaunchAgent with RunAtLoad and KeepAlive enabled, then immediately loads it via launchctl. That establishes automatic persistence for the proxy process without any interactive confirmation, uninstall guidance, or guardrails, which is risky because it causes background code execution on every login and can surprise users.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The proxy writes the full request, including the raw payload, to request.json on disk. That can persist sensitive prompts, tokens, metadata, or conversation history in plaintext where other local users, processes, backups, or forensic artifacts may access it without the user's knowledge.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The server logs user questions and model responses directly to the console, exposing conversational content to terminal history, log collectors, process supervisors, or other users with system access. Because this skill may mediate voice or chat interactions, the logged content could include sensitive personal or operational data.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This script issues physical-device control requests over the network immediately when invoked, without any built-in user confirmation, disclosure, or safety interlock. In the context of a robot-control skill, that means a caller can cause audible speech and behavior-control changes on a real device, which can surprise nearby people, disrupt normal robot operation, or be abused for nuisance and social-engineering effects.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script captures an image from a physical robot's camera and writes it to disk at a predictable path without any built-in notice, consent check, or disclosure to the user. In a robotics skill, silent persistence of camera data increases privacy risk because snapshots may contain people, interiors, screens, or other sensitive information and may be left accessible to other local processes or users.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script silently assumes behavior control and connects to the robot camera stream over network endpoints without any user-facing warning or transparency. Because this skill is specifically designed to control a physical robot and view through its camera, undisclosed activation of these endpoints can enable covert surveillance or unexpected robot takeover within the local environment.

Session Persistence

Medium
Category
Rogue Agent
Content
## LaunchAgent (Auto-start on macOS)

Install to `~/Library/LaunchAgents/com.openclaw.vector-proxy.plist` for auto-start. See `scripts/install-launchagent.sh`.

## API Reference
Confidence
89% confidence
Finding
plist

Session Persistence

Medium
Category
Rogue Agent
Content
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
NODE_PATH=$(which node)
PLIST_PATH="$HOME/Library/LaunchAgents/com.openclaw.vector-proxy.plist"

cat > "$PLIST_PATH" << EOF
<?xml version="1.0" encoding="UTF-8"?>
Confidence
85% confidence
Finding
PLIST

Session Persistence

Medium
Category
Rogue Agent
Content
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
NODE_PATH=$(which node)
PLIST_PATH="$HOME/Library/LaunchAgents/com.openclaw.vector-proxy.plist"

cat > "$PLIST_PATH" << EOF
<?xml version="1.0" encoding="UTF-8"?>
Confidence
85% confidence
Finding
plist

Session Persistence

Medium
Category
Rogue Agent
Content
NODE_PATH=$(which node)
PLIST_PATH="$HOME/Library/LaunchAgents/com.openclaw.vector-proxy.plist"

cat > "$PLIST_PATH" << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
Confidence
92% confidence
Finding
PLIST

Session Persistence

Medium
Category
Rogue Agent
Content
</plist>
EOF

launchctl load "$PLIST_PATH"
echo "LaunchAgent installed and started"
echo "Proxy will auto-start on boot"
Confidence
96% confidence
Finding
launchctl load

Session Persistence

Medium
Category
Rogue Agent
Content
</plist>
EOF

launchctl load "$PLIST_PATH"
echo "LaunchAgent installed and started"
echo "Proxy will auto-start on boot"
Confidence
96% confidence
Finding
PLIST

VirusTotal

55/55 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.