Vector Control

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:59 AM UTC
• Version: 1.0.1

Overview

This skill is a legitimate Vector robot-control helper, but it needs Review because it can move a physical robot, capture camera images, and send audio/network requests without enough scoping or safety controls.

Install only if you understand it can control a real Vector robot and access its camera. Use it on a trusted Wirepod host, keep the robot in a clear supervised area, use short bounded movement commands, avoid untrusted --base URLs, and treat snapshots and audio files as potentially sensitive.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/vector_control.py:56

Finding

Unrestricted Network Destination Enables Constrained SSRF and Audio Disclosure

Content

View full analysis

# --boundary-- body = [] body.append(f"--{boundary}".encode()) body.append(b'Content-Disposition: form-data; name="sound"; filename="processed.wav"') body.append(b"Content-Type: audio/wav") body.append(b"") body.append(file_data) body.append(f"--{boundary}--".encode()) body.append(b"") payload = b"\r\n".join(body) req = urllib.request.Request(url, data=payload, headers=headers, method="POST") with urllib.request.urlopen(req) as r: return r.read() ``` ```python p.add_argument("--base", default="http://localhost:8080", help="Wirepod base URL") ``` ```python base = args.base.rstrip("/") serial = args.serial ``` ```python upload_audio(base, serial, temp_wav) ``` ### Technical Analysis The `--base` argument is accepted without validating its scheme, hostname, resolved IP address, or port. It is then directly incorporated into URLs passed to `urllib.request ...[truncated 2009 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/vector_control.py:65

Finding

Missing Movement Bounds and Guaranteed Robot Fail-Safe Cleanup

Content

View full analysis

0: time.sleep(args.time) post(base, "/api-sdk/move_wheels", {"lw":0, "rw":0, "serial":serial}) elif args.cmd == "head": post(base, "/api-sdk/move_head", {"speed":args.speed, "serial":serial}) if args.time and args.time > 0: time.sleep(args.time) post(base, "/api-sdk/move_head", {"speed":0, "serial":serial}) elif args.cmd == "lift": post(base, "/api-sdk/move_lift", {"speed":args.speed, "serial":serial}) if args.time and args.time > 0: time.sleep(args.time) post(base, "/api-sdk/move_lift", {"speed":0, "serial":serial}) ``` ```python elif args.cmd == "patrol": post(base, "/api-sdk/assume_behavior_control", {"priority":"high","serial":serial}) for i in range(args.steps): if args.speak: post(base, "/api-sdk/say_text", {"text":f"{args.phrase} {i+1}", "serial":serial}) time.sleep(1.2) post(base, "/api-sdk/move_wheels", {"lw":args.speed, "rw":args.speed, "serial":serial}) time.sleep(args.step_time) post(base, "/api-sdk/move_wheels", {"lw ...[truncated 4093 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly instructs use of a Python CLI that performs local network calls to Wirepod and writes files via shell-adjacent commands, yet the manifest does not declare any tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: an agent could invoke network and shell-capable behavior without clear user-visible restriction, increasing the chance of unintended robot control or local file operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The snapshot workflow captures camera data from the robot and stores it to local files, but the skill does not clearly warn that this may collect sensitive visual information or leave artifacts on disk. In a robotics context, camera access can expose people, screens, documents, and room layouts, so omitting a privacy warning makes misuse or accidental over-collection more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document exposes camera streaming and physical robot control endpoints without any warning about privacy implications, consent, or the risk of causing unintended movement. In this skill’s context, the endpoints are specifically meant to drive a real robot and access its camera, so omission of safety guidance materially increases the chance of misuse or unsafe operation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/vector_control.py (reported line 142)May include surrounding context.

python

print(f"Processing audio: {args.file} -> {temp_wav}")
        try:
            # ffmpeg -i input -ac 1 -ar 8000 -acodec pcm_s16le output.wav
            subprocess.run([
                "ffmpeg", "-y", "-i", args.file, 
                "-ac", "1", "-ar", "8000", 
                "-f", "wav", "-c:a", "pcm_s16le",

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes controlling Vector through Wirepod's local HTTP API, plus a CLI helper, but this code adds a separate capability to execute a host-installed binary (ffmpeg) on the system. Spawning subprocesses is broader than simple robot control or HTTP API access and is not explicitly declared as part of the skill's stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The patrol and explore commands can autonomously move the physical robot for extended periods without any safety interlock, operator confirmation, bounds checking, or emergency stop handling. In a robot-control skill, this is more dangerous than in a purely digital tool because misuse or accidental invocation can cause physical collisions, falls, or interference with people, pets, and property.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.