ClawHub
Back to skill

Security audit

Rdk X5 Camera

Security checks for vulnerabilities and agentic risk

Overview

This camera skill is mostly purpose-aligned, but it includes root-level setup/tuning commands and broad process-kill commands that users should review before installing.

Install only if you understand the RDK X5 camera stack and are comfortable approving root-level package installation and ISP tuning. Before running commands, separate build and sudo steps, review the tuning script, avoid wildcard package installs where possible, and replace broad pkill commands with shutdown of specific processes or ROS2 nodes.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:104
Finding

Overbroad Process Termination Can Disrupt Unrelated ROS2 Workloads

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:104
Vulnerability Type: Overbroad process matching and termination
Risk Level: Medium

Vulnerable Code

bash
pkill -f "ros2.*cam" ; pkill -f "ros2.*websocket" ; pkill -f "ros2.*codec"

Technical Analysis

The documented shutdown command uses pkill -f, which matches regular expressions against each process's complete command line. The expressions ros2.*cam, ros2.*websocket, and ros2.*codec are broad and are not restricted by an exact executable name, ROS2 node identity, recorded process ID, or the user who launched the process.

Consequently, the commands can match and terminate ROS2 camera, WebSocket, or codec processes that were not started by this skill. The semicolon-separated commands are also executed independently, so failure of one command does not prevent the remaining broad termination attempts.

Attack Path

  1. A device runs this skill's camera services alongside unrelated ROS2 camera, WebSocket, or codec workloads.
  2. An operator or agent follows the documented “stop all camera services” instruction.
  3. pkill -f searches every accessible process command line for each broad regular-expression match.
  4. Matching processes receive the default termination signal, including unrelated workloads whose command lines happen to satisfy the patterns.
  5. Those services stop, causing availability loss until they are manually or automatically restarted.

This issue does not provide privilege escalation by itself. The affected scope is limited to processes the invoking account has permission to signal.

Impact Assessment

Exploitation can cause a local denial of service against unrelated ROS2 workloads. Potential effects include loss of camera capture, video encoding, browser preview, or other robotics functions associated with matching processes. The scope depends on the invoking user's process-signaling permissions; running the comm ...[truncated 97 chars]

Remediation
View remediation

Remediation Suggestions

  • Record the process IDs of services launched by the skill and terminate only those exact PIDs.
  • Prefer ROS2 lifecycle management or explicit node shutdown mechanisms where supported.
  • If process-name matching is unavoidable, constrain it by the invoking user and use exact, validated command-line patterns rather than broad expressions.
  • Display and validate the candidate process list before sending termination signals.
  • Use conditional chaining and verify each target so that one shutdown operation does not unintentionally broaden the affected scope.
  • Avoid running the shutdown command with elevated privileges.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Chaining Abuse

High
Category
Tool Misuse
Confidence
86% confidence
Finding

The chained command make && sudo ./run_tuning.sh combines compilation and privileged execution in a single step, reducing review opportunities between build output and root execution. In an agent context, this makes it easier to compile code and immediately run the resulting or adjacent tooling with elevated privileges, increasing the risk of unintended or unsafe execution.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

bash
cd /app/multimedia_samples/tuning_tool
make && sudo ./run_tuning.sh

用于调整白平衡、曝光、降噪等 ISP 参数（C 源码需先编译）。

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill name/description and nearly all operational instructions are presented in Chinese, while the file does not offer an English alternative or state that the skill is intentionally limited to Chinese-speaking users or a China-specific compliance context. This creates a natural-language locale policy issue because users are not given a language/locale choice or opt-in.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
92% confidence
Finding

The skill instructs use of sudo apt-get install, which requires root privileges and performs system-wide changes. In an agent-assisted workflow, root-level package installation is dangerous because it can modify the OS, install unexpected dependencies, and create a larger blast radius if the command is misapplied or combined with untrusted package sources.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

RealSense:

bash
sudo apt-get install ros-humble-librealsense2* ros-humble-realsense2-* -y
ros2 launch realsense2_camera rs_launch.py \
  enable_rgbd:=true enable_sync:=true \
  align_depth.enable:=true enable_color:=true enable_depth:=true

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill goes beyond narrowly scoped camera start/preview guidance by including package installation, web streaming setup, ISP tuning, and process termination. This scope expansion increases the chance that an agent will perform system-modifying or service-affecting actions a user did not explicitly request, which can lead to unintended exposure or disruption.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

Including sudo apt-get install introduces persistent system modification in a skill whose stated purpose is camera operation. Even if intended to install required drivers, package installation with root privileges can change system state, pull in unexpected packages, and widen the agent's effective authority beyond simple device use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

Compiling and running an ISP tuning tool is outside the declared preview/capture scope and can materially alter camera pipeline behavior. Building local code and executing a privileged tuning script increases risk because it may introduce unreviewed code execution and persistent hardware/image-processing changes.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
90% confidence
Finding

Running sudo ./run_tuning.sh executes a local script as root, giving the script full control over the system. Because local scripts may contain complex or unreviewed actions, this is more dangerous than a simple user-level camera command and can alter system configuration or device state beyond the user's intent.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

bash
cd /app/multimedia_samples/tuning_tool
make && sudo ./run_tuning.sh

用于调整白平衡、曝光、降噪等 ISP 参数（C 源码需先编译）。

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The pkill -f patterns are broad and may terminate unrelated ROS2, websocket, or codec processes whose command lines happen to match. In an agent setting, this can cause denial of service or interruption of other workloads on the device, exceeding the expected scope of stopping only the services launched by this skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.