This skill informs the agent how to use Viam CLI

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:59 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed Viam CLI manager, but it gives an agent broad robotics, data, credential, deployment, and remote-shell authority without enough per-action approval requirements.

Review before installing if you would not want an agent to manage Viam machines broadly. Use it only with Viam accounts and machine parts scoped to the task, require explicit approval for API key creation, remote shell, file copy, module reload/upload, database-user changes, data export, and any deletion, and verify the Homebrew source/version before installing or upgrading the CLI.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned Third-Party Homebrew Tap and Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30–31
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

sh

brew tap viamrobotics/brews
brew install viam

Technical Analysis

The skill instructs the agent to add a non-core Homebrew tap and install its mutable viam formula without pinning an audited repository commit or package version. It also does not require verification of a vendor signature, published checksum, formula contents, or resolved download source.

Although the skill requires user approval before installation, approval controls whether the installation occurs; it does not verify the integrity of the dependency. Homebrew formulas and their referenced installation artifacts can change after this skill has been reviewed. Installation logic executes with the permissions of the account running Homebrew and can access resources available to that account.

Attack Path

1. An attacker compromises the third-party tap, its maintainer account, formula repository, or an artifact referenced by the formula.
2. The attacker modifies the formula or distributed artifact to include malicious installation or runtime behavior.
3. The user approves the installation requested by the skill.
4. The agent runs brew tap viamrobotics/brews, resolving the current mutable state of the repository.
5. The agent runs brew install viam, causing the compromised formula or artifact to be downloaded and executed or installed.
6. The malicious component executes with the Homebrew user’s privileges and may access user-readable files, environment variables, CLI profiles, or subsequently supplied Viam credentials.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the account running Homebrew. The resulting access is bounded by that account’s operating-system privileges but may include user f ...[truncated 261 chars]

Remediation

View remediation

Remediation Suggestions

1. Install only from an authenticated, vendor-documented distribution channel.
2. Pin the Viam CLI to an explicitly approved version and, where feasible, pin the tap to an audited commit rather than consuming its mutable latest state.
3. Verify downloaded artifacts against vendor-published cryptographic checksums or signatures before installation.
4. Inspect and validate the resolved Homebrew formula, source URL, version, and expected digest before execution.
5. Present the exact source, version, and integrity information to the user when requesting installation approval.
6. Perform installation using a least-privileged account and avoid exposing unrelated secrets or privileged environment variables during the process.
7. Maintain an allowlist of approved package sources and versions, and require renewed review before upgrades.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

This skill allows the agent to interact with the Viam robotics platform across all available CLI surfaces, including initial setup, deployment, data management, and the local developer loop.

## Security & Scoping Guardrails
* **No hardcoded credentials:** Never ask the user to paste an API key or Token into the chat. Rely on OpenClaw's environment variable injection. If unauthenticated, instruct the user to run `viam login` in their secure terminal.
* **Read-first approach:** Always prefer listing resources (e.g., `list`, `describe`) before attempting mutations or deletions.
* **Destructive operations:** Always confirm with the user before running any `delete` command across datasets, data pipelines, or machine data.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The command viam machines api-key create creates new credentials, but the skill does not flag this as a highly sensitive operation. Credential generation can expand access persistence and privilege delegation, and in an automated agent context may create secrets that are mishandled, over-scoped, or exposed in logs/output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents viam machines part shell as an available action without requiring explicit user confirmation or warning about the sensitivity of remote shell access. In an agent-executed context, a remote shell can enable arbitrary command execution on managed machines, making this far more dangerous than ordinary read-only CLI usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill lists viam machines part cp without warning that it can transfer files to and from remote machines, potentially exposing sensitive data or introducing unauthorized code/configuration changes. In an agent setting, silent file transfer capabilities materially increase the risk of data exfiltration or tampering.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

* `viam machines part cp` - Copies files to/from a remote machine over Viam's WebRTC tunnel.

### Modules, Hot-Reloading, & Registry
* `viam module generate` - Interactively scaffolds a new module. Can bypass prompts using flags.
* `viam module reload --part-id <machine-part-id>` - **(Hot Reloading)** Bundles local module code, deploys it to the target machine via WebRTC, registers it as a local module, and restarts it.
* `viam module local-app-testing --app-url <url>` - Tests a custom Viam web application locally against machine data.
* `viam module create` - Creates the module entity in the Viam cloud registry.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

Before attempting to run any `viam` commands, verify if the CLI is installed by running `viam version` or checking the system path. 

**If the `viam` CLI is NOT installed:**
1. **STOP and ask for permission:** You must explicitly ask the user: *"The Viam CLI is not installed on your system. Would you like me to install it via Homebrew?"*
2. **Execute Installation (Upon Approval Only):** If the user grants permission, run the following commands sequentially:
   * `brew tap viamrobotics/brews`
   * `brew install viam`