Vector Control

ReviewAudited by ClawScan on May 10, 2026.

Overview

This skill appears to do what it says—control a local Vector robot—but users should supervise movement, camera, and speaker actions.

This looks like a legitimate local Vector/Wirepod control helper. Before installing, make sure you are comfortable letting the agent move the robot, speak through it, capture camera streams to files, and play selected audio. Keep Wirepod on localhost or a trusted private network, use timed movement commands, supervise patrol/explore routines, and release behavior control when finished.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent can move the robot, make it speak, and capture camera output when directed through this skill.

Why it was flagged

The skill exposes real-world robot movement plus camera and speaker actions. This is clearly disclosed and aligned with the purpose, but mistakes or unintended invocations could affect the physical environment or privacy.

Skill content
Use this skill for movement, speech, camera snapshots, patrols, and exploration from the Pi.
Recommendation

Use the skill only when the robot is in a safe area, prefer short timed moves, review patrol/explore commands before running them, and stop or release control when finished.

What this means

If the Wirepod API is exposed beyond the intended host/network, someone or some process with the serial could control the robot.

Why it was flagged

The Wirepod API grants high-priority behavior control using the robot serial. This is necessary for the stated purpose, but it means local API access plus the serial is sufficient for meaningful control.

Skill content
POST /api-sdk/assume_behavior_control?priority=high&serial=ESN
Recommendation

Keep Wirepod bound to localhost or a trusted private network, do not expose the API publicly, and run the release command when manual control is needed.

What this means

Playing audio requires a trusted local ffmpeg installation and processes the selected media file on the host.

Why it was flagged

The audio playback feature runs a local ffmpeg subprocess on a user-selected audio file. The arguments are fixed and shell execution is not used, so this is expected for the feature, but it is still local command execution.

Skill content
subprocess.run(["ffmpeg", "-y", "-i", args.file, "-ac", "1", "-ar", "8000", ...], check=True)
Recommendation

Install ffmpeg from a trusted source and avoid processing untrusted or unexpected media files.