box2robot-skills

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:51 AM UTC
• Version: 1.0.9

Overview

This skill is for real robot control and mostly matches that purpose, but it lacks reliable approval boundaries around physical, financial, and credential-sensitive actions.

Review before installing. Use only with supervised hardware, cleared workspace, trusted server settings, and explicit human approval for calibration, motion, inference deployment, purchases, and third-party task execution. Avoid HTTP B2R_SERVER values, do not pass passwords on the command line, and treat ~/.b2r_token as a sensitive device-control credential.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: b2r.py:83

Finding

Credentials and Device-Control Tokens Can Be Transmitted over Cleartext HTTP

Content

View full analysis

= 2: user, pwd = args[0], args[1] elif len(args) == 1: user = args[0] import getpass pwd = getpass.getpass("Password: ") else: user = input("Username: ") import getpass pwd = getpass.getpass("Password: ") async with aiohttp.ClientSession() as s: resp = await _post(s, server, None, "/api/auth/login", {"username": user, "password": pwd}) ``` ### Technical Analysis The `B2R_SERVER` value is trusted without validating its scheme. Although the default endpoint uses HTTPS, a caller, environment configuration, o ...[truncated 2013 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: b2r.py:68

Finding

JWT Token File Is Created Insecurely and Follows Symbolic Links

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: b2r.py:539

Finding

Server-Controlled Image Filenames Permit Arbitrary Path Traversal Writes

Content

View full analysis

` or `b2r dataset `. 3. The server returns an image re ...[truncated 1063 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: b2r.py:1079

Finding

Calibration Immediately Triggers Destructive Physical Movement Without Confirmation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: b2r.py:1037

Finding

Marketplace Purchases and Third-Party Robot Skills Execute Without Final Approval

Content

View full analysis

") return pp(await _post(s, server, token, f"/api/act/tasks/{rest[0]}/purchase")) elif sub == "run": if not rest: print("Usage: b2r store run [device]") return task_ref = rest[0] target = rest[1] if len(rest) > 1 else device if not target: target = await _auto_select_device(s, server, token) if not target: _need_device() resp = await _post(s, server, token, f"/api/act/tasks/{task_ref}/execute", {"device_id": target}) pp(resp) ``` ### Technical Analysis The `buy` command immediately posts a purchase request without retrieving and displaying the current item, seller, price, or account balance and without asking for confirmation. The `run` command immediately executes a marketplace task on a specified, stored, or automatically selected device. Marketplace task behavior is authored outside this package. Even if the remote platform validates tasks, execution may cause physical movement that cannot be fully assessed from the local audited code. The absence of a final approval step makes accidental or Agent-generated invocations materially dangerous. ### Attack Path #### Purchase path 1. An Agent or user selects an incorrect task identifier, or untrusted content induces a purchase command. 2. The client sends the purchase POST immediately. 3. Account credits are charged without showing the item and price for approval. #### Execution path 1. An Agent or user invokes `store run` with an incorrect or insufficiently reviewed task. 2. The client uses the persisted device or automatically selects the only available ...[truncated 777 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 95% confidence

Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · b2r.py (reported line 663)May include surrounding context.

python

import subprocess
            pattern = os.path.join(tmp, "%06d.jpg")
            try:
                subprocess.run(
                    ["ffmpeg", "-y", "-framerate", str(fps),
                     "-i", pattern, "-c:v", "libx264",
                     "-pix_fmt", "yuv420p", output],

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README presents direct robot-control commands such as move, home, torque off, snapshot, and calibrate as routine quick-start operations without any safety preconditions, workspace checks, or warning about possible physical movement and equipment hazards. In a skill specifically designed to control real robotic arms via a cloud API, this omission can lead users or agents to invoke actions that may damage hardware, surroundings, or cause injury.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill exposes powerful capabilities including network access, file writes, environment-variable credential use, and shell execution via ffmpeg, but it does not declare any explicit tool scope or allowed-tools restrictions. In an agent ecosystem, that omission weakens policy enforcement and can let the skill operate with broader authority than users or orchestrators expect, which is especially risky here because the skill can control physical hardware, access camera data, and persist sensitive tokens locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents destructive operations such as unbind, WiFi clearing, factory reset, and trajectory deletion as ordinary callable actions without emphasizing that they are irreversible or high-risk. In an autonomous agent setting, this increases the chance of accidental device loss, configuration destruction, or dataset deletion from misunderstood prompts or prompt injection routed through broad commands like exec or natural language control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill exposes microphone enablement and audio recording capabilities without any consent flow, recording indicator guidance, or privacy warning. In an agent-executed context, this creates a real risk of covert or unexpected capture of nearby speech and other sensitive audio, especially because the document is written to instruct LLM agents how to invoke those commands directly.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILLS.md (reported line 247)May include surrounding context.

bash

# Login
curl -X POST https://robot.box2ai.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"xxx","password":"xxx"}'
# → {"token": "eyJ..."}

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill includes the ability to execute third-party ACT Store tasks directly on robotic devices. In this context, running externally authored automation against physical hardware is materially dangerous because it can trigger unreviewed arm motion or other device actions without any local validation, sandboxing, or safety interlock.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The store buy command enables account-spending actions from the CLI, extending beyond core robot control into financial/account operations. If this tool is exposed through an agent or automation pipeline, a prompt or workflow could trigger unintended purchases using the caller's authenticated token.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Movement-affecting commands such as move, home, and torque changes are issued immediately to a physical robotic arm without confirmation, bounds checks, or safety prompts. In a robotics context this increases the chance of accidental or agent-driven unsafe motion, potentially causing hardware damage or injury.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

While the manifest says the skill can generate videos, it does not disclose that this is implemented by invoking a local external executable. Spawning subprocesses is a materially broader host capability than ordinary cloud-API robot control and is not obviously implied unless explicitly declared.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · b2r.py (reported line 663)May include surrounding context.

python

import subprocess
            pattern = os.path.join(tmp, "%06d.jpg")
            try:
                subprocess.run(
                    ["ffmpeg", "-y", "-framerate", str(fps),
                     "-i", pattern, "-c:v", "libx264",
                     "-pix_fmt", "yuv420p", output],

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Purchased store skills can be executed on a device with no warning that the action is third-party code/automation controlling physical hardware. Because this crosses trust boundaries and targets robots, the lack of disclosure and confirmation substantially raises the risk of unsafe or unintended device behavior.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: aiohttp has 16 known advisory(ies) (CVE-2024-52303 (aiohttp has a memory leak when middleware is enabled when requesting a resource ); CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The dependency specification uses a lower bound only (aiohttp>=3.8), which leaves resolution open to any later version and does not demonstrate that a non-vulnerable release will be installed in all environments. Because aiohttp has multiple known advisories across versions, the absence of an upper bound or lockfile makes the deployed security posture unverifiable and can result in vulnerable installations through normal dependency resolution or stale environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.