T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:45- Finding
Unverified Remote Shell Script Is Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
VacuumControl
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Roborock vacuum control guide, but its install steps and device-control authority deserve manual review before use.
Review this skill before installing. Prefer installing uv and roborock-cli through trusted, pinned, or verified package channels instead of running remote scripts through a shell. Confirm the exact device, room, routine, and map-save path before allowing commands, and treat Roborock auth files and exported maps as sensitive home data.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:50- Finding
PowerShell Downloads and Evaluates an Unverified Remote Script with Execution-Policy Bypass
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:57- Finding
Roborock CLI Is Installed Without Version or Artifact Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
通过管道把远程内容直接送入
sh属于典型命令链滥用模式，会绕过人工审阅并立即执行网络返回数据。该 skill 是操作手册性质，用户很可能照抄执行，因此上下文使该模式更危险。- Content
macOS / Linux：
bash curl -LsSf https://astral.sh/uv/install.sh | shWindows：
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 93% confidence
- Finding
rm -rf ~/.cache/roborock-cli/会递归删除本地认证和缓存数据，可能导致认证失效、状态丢失或影响其他自动化流程。虽然目标路径相对具体，但这是破坏性文件操作，若在未经确认的情况下执行会造成数据删除。- Content
bash uv tool uninstall roborock-cli rm -rf ~/.cache/roborock-cli/ # 清理认证和缓存
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 93% confidence
- Finding
rm -rf ~/.cache/roborock-cli/会递归删除本地认证和缓存数据，可能导致认证失效、状态丢失或影响其他自动化流程。虽然目标路径相对具体，但这是破坏性文件操作，若在未经确认的情况下执行会造成数据删除。- Content
bash uv tool uninstall roborock-cli rm -rf ~/.cache/roborock-cli/ # 清理认证和缓存
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 89% confidence
- Finding
rm ~/.cache/roborock-cli/device_cache.pkl删除的是单一缓存文件，破坏范围有限，但仍属于会修改本地状态的删除操作。上下文是修复频率限制相关缓存异常，因此风险较低但真实存在。- Content
修复：
bash rm ~/.cache/roborock-cli/device_cache.pkl roborock-cli devices # 重建缓存
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
触发词包含“扫地”“拖地”“回充”等高频日常词，容易在普通对话或无意图场景下误触发该 skill。由于该 skill 后续包含设备控制、认证和本地缓存删除等敏感操作，误激活会放大执行危险性。
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
文档开头直接声明指导安装和控制设备，但没有集中提示其会改变物理设备状态、触发认证流程、写入或删除本地认证缓存。缺少统一安全警告会让操作者低估风险，在未确认环境和用户授权时执行敏感命令。
- Content
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
诊断：
bash ls -la ~/.cache/roborock-cli/device_cache.pkl # 正常 ~3KB，0 字节说明缓存写入失败
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The map command exposes location-sensitive household layout data and supports saving a PNG to an arbitrary local path, but the documentation provides no warning about privacy implications or local file creation. In this skill context, map retrieval is legitimate, but indoor maps and robot/charger coordinates can reveal sensitive information about a user's home and may be mishandled or stored insecurely by downstream tooling.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
技能的自然语言描述直接规定“教 OpenClaw 如何安装、配置和使用”且全文仅以中文编写，没有说明可根据用户偏好切换语言。按照语言/locale 政策，若未提供用户选择或明确的区域性合理依据，这种默认强制单一语言可能构成政策问题。
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
curl ... | sh会把远程获取的脚本直接交给 shell 执行，完全依赖传输链路和远端内容可信。若安装源被劫持、域名遭污染或脚本内容变更，操作者会在本机执行任意代码。- Content
macOS / Linux：
bash curl -LsSf https://astral.sh/uv/install.sh | shWindows：
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The
start-cleansection explains how to begin full-home or room cleaning but provides no caution that it will immediately trigger physical device activity in the user's environment. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data, privacy, or system integrity; here the omission concerns direct system/device effects.- Content
Static analysis
No suspicious patterns detected.