Security audit

RealWorldClaw

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it controls real hardware and handles credentials with weak safety and security guardrails.

Install only if you are comfortable letting an agent send commands to real ESP32-connected hardware. Use it on trusted networks, avoid entering real passwords on the command line, verify `config.json` before login or registration, and treat automation rules as live hardware controls that may repeat until stopped.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/rwc.py:75
Finding: MQTT TLS Certificate Verification Is Explicitly Disabled
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/rwc.py:216
Finding: Arbitrary JSON Fields Can Override Allowlisted Physical Device Commands
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/rwc.py:123
Finding: Login and Registration Credentials Can Be Sent to an Arbitrary Configured API Endpoint
Content: View full analysis
dict: return self.http.get("/health").json() def modules(self) -> dict: return self.http.get("/modules").json() def register(self, username: str, email: str, password: str) -> dict: return self.http.post("/auth/register", json={ "username": username, "email": email, "password": password }).json() def login(self, email: str, password: str) -> dict: return self.http.post("/auth/login", json={ "email": email, "password": password }).json() ``` The configurable URL is used without origin or scheme validation: ```python def cmd_api(args, config): """Platform API commands.""" api = PlatformAPI(config.get("api_url", DEFAULT_API)) ``` ### Technical Analysis The API base URL is loaded from `config.json` and passed directly to `httpx.Client`. The code does not require HTTPS, validate the destination hostname, or restrict credential-bearing requests to an approved API origin. The `register` and `login` methods transmit plaintext password values in request bodies to this configured endpoint. HTTPS protects the default URL, but a modified configuration can select an attacker-controlled HTTPS endpoint or an unencrypted HTTP endpoint. This is especially dangerou ...[truncated 1258 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/rwc.py:335
Finding: Passwords Are Accepted Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Python Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The act command performs immediate physical-world operations on relays, servos, LEDs, and buzzers without confirmation, authorization checks, or safety interlocks. In a skill explicitly designed to control real hardware, silent actuation materially increases the risk of unsafe motion, power switching, equipment damage, or harm caused by prompt injection or accidental invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The monitor loop automatically converts sensor input into real-world actions based on persisted rules, with no approval step, validation of rule safety, or fail-safe constraints. Because this skill's core context is physical device control, autonomous triggering is especially dangerous: malformed sensor data, spoofed MQTT messages, or unsafe rules can repeatedly actuate hardware without human oversight.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill exposes capabilities that imply file access and network communication but does not declare any explicit tool scope or permission boundaries. In an agent environment, this can lead to overbroad tool use, making it harder to enforce least privilege and increasing the chance that the skill can read local configuration/secrets or send device commands without clear policy controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This skill enables physical-world actions such as relay, servo, LED, buzzer, and automation control, but it does not prominently warn that executing these commands can cause real-world effects or require user confirmation and safety checks. In the context of IoT and actuator control, an agent could trigger unsafe or unintended actions that affect equipment, environments, or people.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The code writes rule data to disk via RULES_PATH.write_text(), creating persistent changes to the local filesystem. Although the surrounding function manages rules, there is no explicit warning in the save path itself or adjacent comments/docstrings disclosing that user actions will modify a local file.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest frames this skill around controlling ESP32/IoT devices, reading sensors, actuating hardware, and creating automation rules. Implementing user account registration and login against a cloud platform adds identity-management capability that is not clearly justified by the stated physical-device control purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.