ClawHub
Back to skill

Security audit

Rdk X5 Gpio

Security checks for vulnerabilities and agentic risk

Overview

This hardware-control skill matches its stated purpose, but it gives broad root-level hardware commands without enough safety scoping or confirmation guidance.

Install only if you intend to let an agent guide RDK X5 hardware control. Before running any command, verify the board model, pin mapping, voltage levels, attached devices, bus addresses, CAN bitrate, and whether the hardware is in a safe test state. Avoid arbitrary I2C writes or CAN sends on live equipment, review sample scripts before using `sudo`, and prefer pinned or OS-vendor packages for `spidev`.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:92
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 92
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

bash
ls /dev/spidev*
pip3 install spidev

Technical Analysis

The skill instructs users to install spidev through pip without specifying a reviewed version, validating package hashes, using a lockfile, or identifying a trusted package index. Consequently, the installed artifact is determined by the package index and resolver state at execution time rather than by the audited project.

This creates a supply-chain risk: a compromised package release, compromised package-index account, malicious dependency, or attacker-controlled pip index configuration could cause different and potentially malicious code to be installed. Python packages can execute package-defined build or installation logic during installation, and imported package code executes when the user subsequently runs the SPI example.

Attack Path

  1. An attacker compromises the relevant package release or a dependency, or influences the victim's pip index configuration.
  2. A user follows the skill's SPI setup instructions and runs pip3 install spidev.
  3. Pip retrieves the mutable, unverified package or dependency from the configured index.
  4. Malicious code executes during package build or installation, or later when spidev is imported.
  5. The payload operates with the privileges of the user who invoked pip or the subsequent Python process.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user's privileges. The accessible scope may include that user's files, environment variables, credentials available to the process, network access, and hardware devices permitted to the account. If the command is independently run from an elevated environment, the impact would increase accordingly; however, th ...[truncated 69 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin spidev to a reviewed, exact version rather than allowing pip to select the latest available release.
  • Store dependency versions in a lockfile or requirements file with cryptographic hashes and install them using pip install --require-hashes -r requirements.txt.
  • Explicitly document and enforce a trusted package index instead of relying on mutable user or system pip configuration.
  • Prefer a vendor-maintained, cryptographically verified operating-system package when one is available for the RDK X5 platform.
  • Install the dependency in an isolated virtual environment with minimal privileges.
  • Review the pinned package artifact and its transitive dependencies before updating versions.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (15)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
81% confidence
Finding

The skill instructs the user to run a privileged configuration utility with sudo, which changes hardware interface multiplexing and system configuration. In a skill context, encouraging root execution without guardrails increases the chance of unsafe or unintended system-level modifications, especially if invoked automatically by an agent.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

pip3 show Hobot.GPIO

引脚功能复用配置（v3.3.3+ 支持自动复用）

sudo srpi-config

→ Interface Options → 选择需要的总线

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill provides direct hardware-control commands for GPIO, PWM, I2C, SPI, UART, and CAN, including write and actuation operations, but it does not include explicit safety constraints, confirmation requirements, or warnings about risks to connected hardware. In this context, the danger is not classic software compromise but unsafe physical side effects: bus misconfiguration, unintended actuator movement, or writes to peripheral registers that can damage devices or create unsafe states.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
90% confidence
Finding

This command uses sudo for I2C bus scanning, which performs active probing of devices on the bus. Although common for diagnostics, active probing as root can interfere with sensitive peripherals and, in an agent-driven context, may be executed without adequate user awareness of attached hardware risks.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash
ls /dev/i2c-*                             # 查看总线
sudo i2cdetect -y 1                       # 扫描总线 1
sudo i2cget -y 1 0x48 0x00               # 读寄存器
sudo i2cset -y 1 0x48 0x01 0xFF          # 写寄存器

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
88% confidence
Finding

The skill includes a privileged i2cget command that reads a device register directly from a specified address. While reading is less dangerous than writing, direct root-level bus access can still disrupt devices with unusual register semantics and normalizes unrestricted privileged hardware access in an automation context.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

bash
ls /dev/i2c-*                             # 查看总线
sudo i2cdetect -y 1                       # 扫描总线 1
sudo i2cget -y 1 0x48 0x00               # 读寄存器
sudo i2cset -y 1 0x48 0x01 0xFF          # 写寄存器

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
95% confidence
Finding

The sudo i2cset example performs a privileged write to an arbitrary I2C device register, which can reconfigure, disable, or damage attached peripherals depending on the target. In a hardware-control skill, this is especially risky because it presents a state-changing bus write with no safety warning, target validation, or limitation to a known-safe device.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

ls /dev/i2c-* # 查看总线 sudo i2cdetect -y 1 # 扫描总线 1 sudo i2cget -y 1 0x48 0x00 # 读寄存器 sudo i2cset -y 1 0x48 0x01 0xFF # 写寄存器

text

### 5. SPI 通信

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
87% confidence
Finding

This privileged command configures CAN interface parameters at the system level. Root-level network/bus reconfiguration can disrupt existing communications and may affect connected control systems if applied to live hardware without change-management or confirmation.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

7. CAN 总线

bash
sudo ip link set can0 type can bitrate 500000
sudo ip link set can0 up
cansend can0 123#DEADBEEF          # 发送
candump can0                       # 接收

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
85% confidence
Finding

Bringing can0 up with sudo enables the interface and may immediately place the system on a live CAN bus. In environments where CAN controls machinery or vehicles, activating an interface without safety notes or operator confirmation can have real operational consequences.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

bash
sudo ip link set can0 type can bitrate 500000
sudo ip link set can0 up
cansend can0 123#DEADBEEF          # 发送
candump can0                       # 接收

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
78% confidence
Finding

The skill directs users to run sample scripts as root, and those scripts control physical interfaces. Because the script contents are not summarized or constrained here, recommending sudo execution broadens the blast radius of any script behavior, including unintended pin toggling or bus writes.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

bash
cd /app/40pin_samples
sudo python3 simple_out.py         # GPIO 输出
sudo python3 simple_pwm.py         # PWM
sudo python3 button_event.py       # 按钮事件
sudo python3 test_i2c.py           # I2C

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

This sample PWM script is run with root privileges and may actuate connected servos, motors, or LEDs. The combination of privilege elevation and physical actuation raises safety concerns if the hardware is not prepared or the user does not understand the movement/output that will occur.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

bash
cd /app/40pin_samples
sudo python3 simple_out.py         # GPIO 输出
sudo python3 simple_pwm.py         # PWM
sudo python3 button_event.py       # 按钮事件
sudo python3 test_i2c.py           # I2C
sudo python3 test_spi.py           # SPI

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
76% confidence
Finding

Running a button-event sample as root is less inherently dangerous than write-heavy examples, but it still normalizes privileged execution of hardware scripts without necessity analysis. If the script contains additional setup logic, root execution could have broader effects than the user expects.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md
cd /app/40pin_samples
sudo python3 simple_out.py         # GPIO 输出
sudo python3 simple_pwm.py         # PWM
sudo python3 button_event.py       # 按钮事件
sudo python3 test_i2c.py           # I2C
sudo python3 test_spi.py           # SPI
sudo python3 test_serial.py        # UART

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
89% confidence
Finding

The root-level I2C sample script likely performs device probing or register access on attached peripherals. Without describing the target hardware or script behavior, the skill encourages privileged execution of potentially state-changing hardware operations that may disrupt or misconfigure devices.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

sudo python3 simple_out.py # GPIO 输出 sudo python3 simple_pwm.py # PWM sudo python3 button_event.py # 按钮事件 sudo python3 test_i2c.py # I2C sudo python3 test_spi.py # SPI sudo python3 test_serial.py # UART

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
86% confidence
Finding

This SPI sample is executed as root and may transmit arbitrary data to connected peripherals. On embedded systems, privileged bus access combined with opaque sample behavior can alter peripheral state or interfere with active devices if run on live hardware.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

sudo python3 simple_pwm.py # PWM sudo python3 button_event.py # 按钮事件 sudo python3 test_i2c.py # I2C sudo python3 test_spi.py # SPI sudo python3 test_serial.py # UART

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
83% confidence
Finding

The UART sample is run with sudo and may send serial data to whatever is attached to the target port. In embedded or industrial environments, unsolicited serial commands can trigger configuration changes or actions on downstream devices, making privileged, unexplained execution risky.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

sudo python3 button_event.py # 按钮事件 sudo python3 test_i2c.py # I2C sudo python3 test_spi.py # SPI sudo python3 test_serial.py # UART

text

## 排查故障

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
74% confidence
Finding

The troubleshooting table recommends using sudo to resolve permission issues, which can lead users to default to root rather than understanding device permissions or safer alternatives. While not malicious, it reinforces a pattern of unnecessary privilege escalation throughout the skill.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md
| 现象 | 原因 | 解决 |
|------|------|------|
| `Permission denied` | 未用 sudo 或引脚被占用 | `sudo` 运行脚本 |
| I2C 扫描无设备 | 总线未启用或接线错误 | `srpi-config` 启用 I2C；检查 SDA/SCL 接线 |
| PWM 无输出 | 引脚复用冲突 | `srpi-config` 确认引脚已配置为 PWM 功能 |
| CAN 无法 up | 内核模块未加载 | `sudo modprobe can_raw`；检查 `/boot/config.txt` |

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

The troubleshooting guidance includes sudo modprobe can_raw, which loads a kernel module as root. Kernel-module operations are privileged and can alter system behavior; presenting them casually in a skill without warning or operator context increases the risk of unintended system changes.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md
| `Permission denied` | 未用 sudo 或引脚被占用 | `sudo` 运行脚本 |
| I2C 扫描无设备 | 总线未启用或接线错误 | `srpi-config` 启用 I2C；检查 SDA/SCL 接线 |
| PWM 无输出 | 引脚复用冲突 | `srpi-config` 确认引脚已配置为 PWM 功能 |
| CAN 无法 up | 内核模块未加载 | `sudo modprobe can_raw`；检查 `/boot/config.txt` |