ClawHub
Back to skill

Security audit

商服机器人

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed robot-control guide, but it gives agents unrestricted root SSH access to a physical robot for a workflow that only needs scoped ROS messaging.

Install only if you trust the robot, network, and publisher, and understand that an agent using this skill may have root-level control over the robot. Prefer a dedicated least-privilege robot account or broker that only permits the documented /agent/cmd, /agent/reply, and /audio operations, and avoid shared root credentials.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The documentation says agents must not directly operate the internal control topic `/instruct`, but the provided access model gives the agent full root SSH command execution on the robot. That means the prohibition is purely advisory and can be bypassed trivially to publish to `/instruct`, stop processes, or run arbitrary ROS and shell commands, expanding the skill from a constrained messaging interface into unrestricted remote control.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The document explicitly forbids writing or modifying code on the robot, yet it provides reusable root SSH credentials and example code that executes arbitrary shell commands remotely. With root access, an agent can modify files, alter ROS nodes, plant persistence, or disable safety controls, so the stated restriction is unenforced and ineffective.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.