Security audit
Security checks for vulnerabilities and agentic risk
This satellite pass notifier is not malicious, but it should be reviewed because one included scheduler can run configured shell commands automatically and pass along the process environment.
Review before installing. The alerting and state files are normal for this kind of scheduler, but only enable capture/decode commands if you wrote and trust them, run the cron job as a low-privilege user, and avoid exposing secrets in the environment used by the scheduled process.
The documented purpose understates important behaviors, especially arbitrary shell-command execution via capture hooks and local state persistence. This mismatch is dangerous because operators may approve or run the skill expecting a simple pass notifier, while it actually has broader execution and persistence capabilities that could be abused for command execution or covert side effects.
Copying the full parent environment into an arbitrary shell-executed capture command can leak secrets such as API tokens, credentials, service endpoints, or session data to that command and any child processes. In combination with configurable shell execution, this significantly increases the value of the execution primitive and enables credential exfiltration.
(run_dir / "pass.json").write_text(json.dumps(p, indent=2), encoding="utf-8")
# Run capture command in shell, with timeout
env = os.environ.copy()
env["RADIO_RUN_DIR"] = str(run_dir)
env["SAT_NORAD"] = str(norad)
env["SAT_NAME"] = name
Passing a configuration-controlled string into subprocess.run with shell=True is a classic arbitrary command execution pattern. In this skill context, it is especially dangerous because the task is expected to run automatically on a schedule, turning a radio pass alert tool into an unattended code-execution mechanism.
env["PASS_END"] = p["passEnd"]
env["PASS_MAX"] = p["passMax"]
try:
subprocess.run(cmd, shell=True, cwd=str(run_dir), env=env, timeout=timeout)
except Exception:
pass
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Copy the example config:
mkdir -p ~/.clawdbot/radio-copilot
cp config.example.json ~/.clawdbot/radio-copilot/config.json
chmod 600 ~/.clawdbot/radio-copilot/config.json
Lines L67-L72 say the end-to-end Pi/Jetson capture/decode pipeline is 'still in planning and development' and that the repo currently focuses on pass prediction, orchestration, and alerts. However, L85-L87 states the host's job is to 'trigger remote capture/decode via SSH,' which describes implemented operational behavior rather than a merely planned architecture. These statements create an intent-level contradiction in the documentation about whether remote execution/orchestration is present now or only planned.
The skill advertises operational behavior that implies filesystem, network, and shell access, yet it does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, this weakens reviewability and containment because a user or orchestrator cannot easily tell that the skill may read/write local state, send alerts, or invoke external commands.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p ~/.clawdbot/radio-copilot
cp config.example.json ~/.clawdbot/radio-copilot/config.json
chmod 600 ~/.clawdbot/radio-copilot/config.json
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
mkdir -p ~/.clawdbot/radio-copilot
cp config.example.json ~/.clawdbot/radio-copilot/config.json
chmod 600 ~/.clawdbot/radio-copilot/config.json
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
mkdir -p ~/.clawdbot/radio-copilot
cp config.example.json ~/.clawdbot/radio-copilot/config.json
chmod 600 ~/.clawdbot/radio-copilot/config.json
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def send_whatsapp(channel: str, target: str, message: str) -> None:
claw = find_clawdbot()
subprocess.run([claw, "message", "send", "--channel", channel, "--target", target, "--message", message], capture_output=True)
def run(cmd: List[str], timeout: int = 30) -> subprocess.CompletedProcess:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def send_whatsapp(channel: str, target: str, message: str) -> None:
claw = find_clawdbot()
subprocess.run([claw, "message", "send", "--channel", channel, "--target", target, "--message", message], capture_output=True)
def run(cmd: List[str], timeout: int = 30) -> subprocess.CompletedProcess:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(cmd: List[str], timeout: int = 30) -> subprocess.CompletedProcess:
return subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
def ssh(host: str, remote_cmd: str, timeout: int = 60, user: Optional[str] = None) -> subprocess.CompletedProcess:
The docstring reassures readers that the scheduler is 'conservative and safe,' yet the code later executes arbitrary shell commands from configuration. This misleading safety claim can reduce scrutiny and cause operators to deploy the tool with more trust and privilege than they otherwise would.
The code attempts to resolve Node with subprocess.check_output(["command", "-v", "node"]), but 'command' is a shell builtin and not a standalone executable on many systems, causing unreliable behavior. More importantly, falling back to 'node' or trusting PATH can execute an attacker-controlled binary if the environment PATH is compromised in the scheduler context.
def run_pass_predictor(norad: int, lat: float, lon: float, height_m: float, min_el: float, lookahead_min: float) -> List[dict]:
node = subprocess.check_output(["command", "-v", "node"], text=True).strip() or "node"
script = Path(__file__).with_name("pass_predictor.mjs")
cmd = [
node,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"--look-ahead-min",
str(lookahead_min),
]
p = subprocess.run(cmd, capture_output=True, text=True)
if p.returncode != 0:
raise RuntimeError(p.stderr.strip() or "pass predictor failed")
out = []
The skill is presented primarily as a pass scheduler/alerter, but it includes hidden general-purpose command execution during pass windows. That mismatch is dangerous because users may enable the skill expecting notifications while unintentionally granting unattended remote-execution capability to whoever controls its configuration or updates.
Invoking a shell to run configured commands is substantially broader than what a pass-alerting copilot needs. In this context, the extra capability materially increases risk because the scheduler runs unattended and can execute arbitrary payloads whenever a matching event occurs.
The scheduler automatically executes shell commands during pass windows without any runtime confirmation or prominent warning. In an unattended cron-style context, that means dangerous actions can occur silently after initial setup, magnifying the blast radius of misconfiguration or malicious config changes.
This runs a configuration-supplied command through the shell with shell=True, which allows arbitrary command execution in the scheduler's security context. Because the command is triggered automatically during pass windows, any party able to modify configuration can achieve unattended code execution and potentially pivot further using inherited environment and filesystem access.
env["PASS_END"] = p["passEnd"]
env["PASS_MAX"] = p["passMax"]
try:
subprocess.run(cmd, shell=True, cwd=str(run_dir), env=env, timeout=timeout)
except Exception:
pass
This manifest file sets the time zone to "Europe/London" directly, which imposes a specific locale-related setting in natural language/config form. There is no indication in the file that the user is expected to choose or confirm this locale, so it may violate the policy against forcing a language/locale without opt-in.
This code sends message content and a target identifier to an external CLI without any runtime log, confirmation, or local comment at the call site explaining that user/system data is being transmitted. Although the module docstring mentions WhatsApp alerts generally, this function performs the actual outbound transmission silently.
The send_notify function transmits satellite pass details to an external messaging channel using clawdbot message send, but there is no log/print/comment at the call site indicating that data is being sent out. The top-level docstring mentions alerts are optional, yet the actual transmission lacks a visible runtime disclosure for users or operators.
No suspicious patterns detected.