This skill informs the agent how to use Viam CLI

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:59 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed Viam CLI manager, but it gives an agent broad robotics, data, credential, deployment, and remote-shell authority without enough per-action approval requirements.

Review before installing if you would not want an agent to manage Viam machines broadly. Use it only with Viam accounts and machine parts scoped to the task, require explicit approval for API key creation, remote shell, file copy, module reload/upload, database-user changes, data export, and any deletion, and verify the Homebrew source/version before installing or upgrading the CLI.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30
• Finding: Unpinned Third-Party Homebrew Tap and Package## Vulnerability Details **File Location**: `SKILL.md`, lines 30–31 **Vulnerability Type**: Supply-chain exposure through an unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```sh brew tap viamrobotics/brews brew install viam ``` ### Technical Analysis The skill instructs the agent to add a non-core Homebrew tap and install its mutable `viam` formula without pinning an audited repository commit or package version. It also does not require verification of a vendor signature, published checksum, formula contents, or resolved download source. Although the skill requires user approval before installation, approval controls whether the installation occurs; it does not verify the integrity of the dependency. Homebrew formulas and their referenced installation artifacts can change after this skill has been reviewed. Installation logic executes with the permissions of the account running Homebrew and can access resources available to that account. ### Attack Path 1. An attacker compromises the third-party tap, its maintainer account, formula repository, or an artifact referenced by the formula. 2. The attacker modifies the formula or distributed artifact to include malicious installation or runtime behavior. 3. The user approves the installation requested by the skill. 4. The agent runs `brew tap viamrobotics/brews`, resolving the current mutable state of the repository. 5. The agent runs `brew install viam`, causing the compromised formula or artifact to be downloaded and executed or installed. 6. The malicious component executes with the Homebrew user’s privileges and may access user-readable files, environment variables, CLI profiles, or subsequently supplied Viam credentials. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the account running Homebrew. The resulting access is bounded by that account’s operating-system privileges but may include user f ...[truncated 261 chars]
• Remediation: ## Remediation Suggestions 1. Install only from an authenticated, vendor-documented distribution channel. 2. Pin the Viam CLI to an explicitly approved version and, where feasible, pin the tap to an audited commit rather than consuming its mutable latest state. 3. Verify downloaded artifacts against vendor-published cryptographic checksums or signatures before installation. 4. Inspect and validate the resolved Homebrew formula, source URL, version, and expected digest before execution. 5. Present the exact source, version, and integrity information to the user when requesting installation approval. 6. Perform installation using a least-privileged account and avoid exposing unrelated secrets or privileged environment variables during the process. 7. Maintain an allowlist of approved package sources and versions, and require renewed review before upgrades.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

This skill allows the agent to interact with the Viam robotics platform across all available CLI surfaces, including initial setup, deployment, data management, and the local developer loop.

## Security & Scoping Guardrails
* **No hardcoded credentials:** Never ask the user to paste an API key or Token into the chat. Rely on OpenClaw's environment variable injection. If unauthenticated, instruct the user to run `viam login` in their secure terminal.
* **Read-first approach:** Always prefer listing resources (e.g., `list`, `describe`) before attempting mutations or deletions.
* **Destructive operations:** Always confirm with the user before running any `delete` command across datasets, data pipelines, or machine data.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The command `viam machines api-key create` creates new credentials, but the skill does not flag this as a highly sensitive operation. Credential generation can expand access persistence and privilege delegation, and in an automated agent context may create secrets that are mishandled, over-scoped, or exposed in logs/output.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill documents `viam machines part shell` as an available action without requiring explicit user confirmation or warning about the sensitivity of remote shell access. In an agent-executed context, a remote shell can enable arbitrary command execution on managed machines, making this far more dangerous than ordinary read-only CLI usage.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill lists `viam machines part cp` without warning that it can transfer files to and from remote machines, potentially exposing sensitive data or introducing unauthorized code/configuration changes. In an agent setting, silent file transfer capabilities materially increase the risk of data exfiltration or tampering.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

* `viam machines part cp` - Copies files to/from a remote machine over Viam's WebRTC tunnel.

### Modules, Hot-Reloading, & Registry
* `viam module generate` - Interactively scaffolds a new module. Can bypass prompts using flags.
* `viam module reload --part-id <machine-part-id>` - **(Hot Reloading)** Bundles local module code, deploys it to the target machine via WebRTC, registers it as a local module, and restarts it.
* `viam module local-app-testing --app-url <url>` - Tests a custom Viam web application locally against machine data.
* `viam module create` - Creates the module entity in the Viam cloud registry.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Excessive Permissions

Low

• Category: Privilege Escalation

Content

Before attempting to run any `viam` commands, verify if the CLI is installed by running `viam version` or checking the system path. 

**If the `viam` CLI is NOT installed:**
1. **STOP and ask for permission:** You must explicitly ask the user: *"The Viam CLI is not installed on your system. Would you like me to install it via Homebrew?"*
2. **Execute Installation (Upon Approval Only):** If the user grants permission, run the following commands sequentially:
   * `brew tap viamrobotics/brews`
   * `brew install viam`

• Confidence: 80% confidence
• Finding: Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Static analysis

No suspicious patterns detected.