ClawHub
Back to skill

Security audit

ros2-engineering-skills

Security checks for vulnerabilities and agentic risk

Overview

This ROS 2 skill is mostly a coherent engineering guide, but it includes unsafe privileged setup guidance and an input-validation flaw in its package generator.

Review this skill before installing in an agent that may execute suggested commands. Avoid the pipe-to-shell Tailscale command, scrutinize privileged Docker and system-tuning examples before running them, and do not pass untrusted maintainer metadata to scripts/create_package.py unless validation is added.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/security.md:497
Finding

Mutable Remote Installer Executed Directly Through a Shell

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/create_package.py:20
Finding

Unescaped Maintainer Metadata Can Inject Code into Generated Packages

Content
View full analysis
str: return _APACHE2_PY.format(maintainer=maintainer) def _copyright_cpp(maintainer: str = "TODO") -> str: return _APACHE2_CPP.format(maintainer=maintainer) ``` The same unescaped values are embedded in XML: ```python {maintainer_name}
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (139)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description represents a general-purpose ROS 2 expert/guide skill, but the supplied code implements a specific launch-file validator. Its primary purpose is materially different: static checking of Python ROS 2 launch files, not comprehensive ROS 2 engineering assistance. The code does not provide guidance or functionality for most of the listed domains and even explicitly limits itself to .launch.py files, excluding XML and YAML launch files. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description presents this skill as a wide-ranging ROS 2 engineering guide covering nearly the full ROS 2 ecosystem. The supplied code chunk, however, is only a test suite for a package creation script. It verifies that the script scaffolds ROS 2 C++/Python/interfaces packages with expected files and metadata, and checks CLI validation behaviors. That is a legitimate ROS 2-related utility, but it is materially narrower than the declared purpose. The mismatch is primarily one of scope and primary purpose: the code does not provide comprehensive ROS 2 engineering guidance or functionality across the many listed domains; it only supports package scaffolding. The broad trigger conditions are therefore also inaccurate relative to actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

There is a clear description-behavior mismatch. The declared purpose presents the skill as an expansive ROS 2 engineering guide covering nearly all major ROS 2 subsystems and workflows. In contrast, the supplied code is narrowly focused on testing a single utility for static analysis of ROS 2 launch files. While this falls within the broad ROS 2 ecosystem, it does not substantiate the claimed comprehensive functionality. The code neither implements guidance across the listed domains nor demonstrates capabilities beyond launch validation. This is not merely an incomplete snippet of a large guide; the observable behavior is specifically a validator test suite with CLI and AST/rule checks, making the declared purpose materially broader and different from the actual code behavior.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
| ROS 1 migration, ros1_bridge, hybrid operation | `references/migration-ros1.md` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.

md
| ROS 1 migration, ros1_bridge, hybrid operation | `references/migration-ros1.md` |

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/communication.md (reported line 387)May include surrounding context.

reduces CPU overhead and network bandwidth for subscribers that only need a subset of messages.

Basic API

cpp
auto options = rclcpp::SubscriptionOptions();
// SQL-like filter expression with positional parameters
// Filter on top-level fields of the message type only
options.content_filter_options.filter_expression = "temperature > %0";
options.content_filter_options.expression_parameters = {"80.0"};

auto sub = create_subscription<sensor_msgs::msg::Temperature>(
  "diagnostics/temperature", rclcpp::SensorDataQoS(),
  [this](const sensor_msgs::msg::Temperature::SharedPtr msg) {
    // Only called when temperature > 80.0 — filtering happens at DDS layer
    RCLCPP_WARN(get_logger(), "High engine temperature: %.1f", msg->temperature);
  },
  options);

Limitation: Content filters operate on top-level message fields only. You cannot filter on nested fields (e.g., status[].level inside DiagnosticArray). For nested filtering, subscribe normally

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/communication.md (reported line 651)May include surrounding context.

CycloneDDS tuning (default vendor)

xml
<!-- cyclonedds.xml -->
<?xml version="1.0" encoding="UTF-8"?>
<CycloneDDS xmlns="https://cdds.io/config">
  <Domain>

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/debugging.md (reported line 488)May include surrounding context.

bash
# Enable core dumps
ulimit -c unlimited
echo '/tmp/core.%e.%p' | sudo tee /proc/sys/kernel/core_pattern

# After crash, analyze with GDB
gdb /path/to/driver_node /tmp/core.driver_node.12345

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/realtime.md (reported line 597)May include surrounding context.

bash
# Enable core dumps
ulimit -c unlimited
echo '/tmp/core.%e.%p' | sudo tee /proc/sys/kernel/core_pattern

# After crash, analyze with GDB
gdb /path/to/driver_node /tmp/core.driver_node.12345

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/realtime.md (reported line 600)May include surrounding context.

bash
# Enable core dumps
ulimit -c unlimited
echo '/tmp/core.%e.%p' | sudo tee /proc/sys/kernel/core_pattern

# After crash, analyze with GDB
gdb /path/to/driver_node /tmp/core.driver_node.12345

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/realtime.md (reported line 670)May include surrounding context.

bash
# Enable core dumps
ulimit -c unlimited
echo '/tmp/core.%e.%p' | sudo tee /proc/sys/kernel/core_pattern

# After crash, analyze with GDB
gdb /path/to/driver_node /tmp/core.driver_node.12345

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/deployment.md (reported line 56)May include surrounding context.

md
rosdep update && \
    rosdep install --from-paths /tmp/src --ignore-src -y \
    --skip-keys "ament_cmake ament_lint_auto" && \
    rm -rf /tmp/src /var/lib/apt/lists/*

# Entry point
COPY docker/entrypoint.sh /entrypoint.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/deployment.md (reported line 56)May include surrounding context.

md
rosdep update && \
    rosdep install --from-paths /tmp/src --ignore-src -y \
    --skip-keys "ament_cmake ament_lint_auto" && \
    rm -rf /tmp/src /var/lib/apt/lists/*

# Entry point
COPY docker/entrypoint.sh /entrypoint.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/deployment.md (reported line 56)May include surrounding context.

md
rosdep update && \
    rosdep install --from-paths /tmp/src --ignore-src -y \
    --skip-keys "ament_cmake ament_lint_auto" && \
    rm -rf /tmp/src /var/lib/apt/lists/*

# Entry point
COPY docker/entrypoint.sh /entrypoint.sh

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

Using --ipc=host shares the host IPC namespace with the container, reducing isolation and potentially exposing shared-memory segments or enabling interference between host and container processes. In robotics deployments, this may be justified for performance, but it still increases blast radius if the container is compromised.

Content

Scanner excerpt · references/deployment.md (reported line 192)May include surrounding context.

For shared memory transport inside Docker:

bash
# Required for iceoryx/CycloneDDS shared memory
docker run --ipc=host ...

2. Cross-compilation (aarch64, armhf)

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

Running a container with --privileged gives it broad access to host devices, kernel capabilities, and security-sensitive interfaces, substantially weakening container isolation. If the image or executed code is compromised, an attacker could pivot to the host and potentially take over the build machine.

Content

Scanner excerpt · references/deployment.md (reported line 201)May include surrounding context.

bash
# Enable multi-arch builds
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes

# Build for ARM64
docker buildx build \

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/hardware-interface.md (reported line 282)May include surrounding context.

-3.14 3.14 ```

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/manipulation.md (reported line 93)May include surrounding context.

"joint_6" value="0"/> </group_state>

<end_effector name="gripper" parent_link="tool0" group="gripper" parent_group="arm"/>

<disable_collisions link1="base_link" link2="link_1" reason="Adjacent"/> <disable_collisions link1="link_1" link2="link_2" reason="Adjacent"/>

```

Kinematics configuration

yaml
# kinematics.yaml
arm:
  kinematics_solver: kdl_kinematics_plugin/KDLKinematicsPlugin
  kinematics_solver_search_resolution: 0.005
  kinematics_solver_timeout: 0.05   # seconds
  # For 6+ DOF arms, consider:
  # kinematics_solver: pick_ik/PickIkPlugin   # Faster for complex IK

Joint limits override

yaml
# joint_limits.yaml — override URDF limits for MoveIt
joint_limits:
  joint_1:
    has_velocity_limits: true
    max_velocity: 2.0             # rad/s

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/migration-ros1.md (reported line 195)May include surrounding context.

erfacespackage withrosidl_generate_interfaces`

Custom bridge mapping for mismatched types

yaml
# mapping_rules.yaml — for types with different names/structures
-
  ros1_package_name: 'my_robot_msgs'
  ros1_message_name: 'RobotStatus'
  ros2_package_name: 'my_robot_interfaces'
  ros2_message_name: 'RobotStatus'
  fields_1_to_2:
    header: 'header'
    mode: 'mode'
    description: 'description'
    battery_voltage: 'battery_voltage'

4. Launch file conversion

ROS 1 XML → ROS 2 Python

ROS 1 (XML):

xml
<launch>
  <arg name="robot_name" default="my_robot"/>
  <arg name="use_sim" default="false"/>

  <param name="robot_description"
         command="$(find xacro)/xacro $(find my_robot_description)/urdf/robot.urdf.xacro"/>

  <node pkg="robot_state_publisher" type="robot_state_publisher"
        name="robot_state_publisher" output="screen"/>

  <node pkg="my_robot_driver" type="driver_node" name="driver"
        ns="$(a

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/realtime.md (reported line 76)May include surrounding context.

md
# x86/amd64 (GRUB bootloader):
# /etc/default/grub — isolate CPUs 2 and 3 for RT
GRUB_CMDLINE_LINUX="isolcpus=2,3 nohz_full=2,3 rcu_nocbs=2,3"
sudo update-grub && sudo reboot

# NVIDIA Jetson (U-Boot/extlinux):
# Edit /boot/extlinux/extlinux.conf, add to APPEND line:

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/security.md (reported line 273)May include surrounding context.

md
<liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
      <rtps_protection_kind>ENCRYPT</rtps_protection_kind>
      <topic_access_rules>
        <!-- High-bandwidth sensors: sign only (integrity without encryption overhead) -->
        <topic_rule>
          <topic_expression>rt/camera/*</topic_expression>
          <enable_discovery_protection>true</enable_discovery_protection>

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/security.md (reported line 453)May include surrounding context.

CORRECT — use only the official OSRF repositories

sudo curl -sSL https://raw.githubusercontent.com/ros/rosdistro/master/ros.key
-o /usr/share/keyrings/ros-archive-keyring.gpg

text

---

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/security.md (reported line 474)May include surrounding context.

DDS multicast discovery is not forwarded over VPN tunnels. Use unicast peer lists:

xml
<!-- cyclonedds_vpn.xml — unicast discovery for VPN -->
<CycloneDDS>
  <Domain>
    <General>

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

Piping a remotely fetched script directly into sh executes unverified code from the network with no integrity check or review step. In a robotics/security guide, this is especially dangerous because a compromised install endpoint, MITM, or supply-chain incident could lead to arbitrary code execution on robots or operator systems.

Content

Scanner excerpt · references/security.md (reported line 499)May include surrounding context.

bash
# Tailscale: install on each robot, assigns 100.x.y.z addresses
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --hostname=robot-001
# Use Tailscale IPs in CycloneDDS peer list

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The use of curl ... | sh combines untrusted network retrieval with immediate shell execution, which is a classic unsafe chaining pattern. Given this skill is about securing ROS 2 systems, including such a pattern weakens the trustworthiness of the guidance and creates a realistic path to arbitrary code execution during deployment.

Content

Scanner excerpt · references/security.md (reported line 499)May include surrounding context.

bash
# Tailscale: install on each robot, assigns 100.x.y.z addresses
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --hostname=robot-001
# Use Tailscale IPs in CycloneDDS peer list

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
references/deployment.md:319