Rdk X5 Quickstart

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:30 AM UTC
• Version: 1.0.0

Overview

This quickstart is mostly coherent, but it gives beginners high-impact setup commands without enough safety guardrails.

Review this skill before installing or using it. Prefer balenaEtcher over dd, verify the target device and image checksum, change default passwords before putting the board on a network, avoid putting Wi-Fi passwords directly in shell commands, and treat the apt upgrade and TROS demo steps as broader system/development guidance outside a minimal first-use quickstart.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:20
• Finding: Unsafe Privileged Disk-Imaging Command Can Overwrite the Host Disk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 17–22 **Vulnerability Type**: Unsafe destructive command **Risk Level**: High ### Vulnerable Code ```markdown 1. Download the latest RDK OS image from the D-Robotics website 2. Use balenaEtcher or `dd` to flash it to a microSD card (≥16 GB): ```bash sudo dd if=rdk_os_image.img of=/dev/sdX bs=4M status=progress && sync ``` 3. Insert the SD card into the RDK X5 ``` ### Technical Analysis The instructions recommend running `dd` with root privileges against a raw block device. The placeholder `/dev/sdX` must be manually replaced, but the Skill does not instruct the user to identify the removable device safely, compare its capacity and model, unmount its partitions, or confirm that it is not the host operating-system disk. Unlike filesystem-aware copy utilities, `dd` writes directly to the selected block device without validating its contents or asking for confirmation. A mistaken target therefore causes immediate destructive writes. The instructions also omit image checksum or signature verification, increasing the possibility of flashing a corrupted or untrusted image. ### Attack Path 1. The user downloads an RDK OS image and inserts a microSD card. 2. The user lists or guesses available device names but incorrectly identifies the host disk as the removable card. 3. The user substitutes that device name for `/dev/sdX`. 4. The command is executed through `sudo`, granting the process unrestricted raw-disk write access. 5. `dd` overwrites the selected disk beginning at its first sectors, destroying partition tables, boot records, filesystems, and data. 6. The host may immediately suffer data corruption or become unbootable after restart. A malicious or compromised image-distribution page could also provide misleading device instructions or a corrupted image, although no such compromise was established during this audit. ### Impact Assessment Successful exploitation or operator error obta ...[truncated 311 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer balenaEtcher or another imaging utility that displays device model, capacity, and removable-media status and requires explicit confirmation. - Before using `dd`, require users to run `lsblk -o NAME,SIZE,MODEL,TRAN,TYPE,MOUNTPOINTS` both before and after inserting the card. - Explicitly warn users never to select the disk containing `/`, `/boot`, or their host operating system. - Require all mounted target partitions to be unmounted before imaging. - Ask the user to confirm the selected device model and capacity immediately before execution. - Verify the image using an official cryptographic checksum or signature. - Use a safer command that reduces accidental target ambiguity, for example: ```bash lsblk -o NAME,SIZE,MODEL,TRAN,TYPE,MOUNTPOINTS # Verify TARGET carefully and ensure it is the removable microSD device. TARGET=/dev/sdX sudo umount "${TARGET}"?* 2>/dev/null || true printf 'This will erase all data on %s. Type the full device path to confirm: ' "$TARGET" read -r CONFIRM [ "$CONFIRM" = "$TARGET" ] || exit 1 sudo dd if=rdk_os_image.img of="$TARGET" bs=4M status=progress conv=fsync ``` - Add a prominent statement that substituting the wrong device can irreversibly erase the host computer. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:27
• Finding: Known Default Credentials Are Not Rotated Before Network Exposure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24–28 **Vulnerability Type**: Hardcoded default credentials **Risk Level**: High ### Vulnerable Code ```markdown ## Step 2: First Boot 1. Connect power (Type-C 5V/3A or 12V DC) 2. Default credentials: `root` / `root` or `sunrise` / `sunrise` 3. After startup, the system automatically obtains an IP address through wired DHCP ``` ### Technical Analysis The Skill documents publicly known default username and password pairs, including a possible direct root account, but does not require users to change them during first boot. The next instruction states that the device automatically obtains an address through DHCP, and later troubleshooting guidance discusses SSH access. Consequently, a device may become reachable while still accepting predictable credentials. Default credentials are not secrets and can be tested by any party with network access to an exposed authentication service. If password-based SSH or another remote login service accepts these credentials, an attacker does not need to exploit a software defect; ordinary authentication is sufficient. The `root` account would provide immediate administrative control, while the `sunrise` account may provide user-level access and potentially administrative access through configured `sudo` permissions. ### Attack Path 1. The RDK X5 starts with one of the documented default credential pairs. 2. The device automatically joins a wired network through DHCP before the owner rotates the credentials. 3. An attacker on the same network discovers the device through DHCP records, ARP scanning, service discovery, or an address scan. 4. The attacker identifies an exposed remote login service, such as SSH. 5. The attacker attempts `root` / `root` or `sunrise` / `sunrise`. 6. If default password authentication remains enabled, the attacker obtains an interactive session. 7. Access as `root` grants immediate full control. Access as `sunrise` grants th ...[truncated 979 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Add a mandatory password-change step immediately after the first local login and before connecting the device to an untrusted network. - Require unique, strong passwords rather than retaining vendor defaults. - Disable direct remote login for `root`, particularly over SSH. - Configure SSH with `PermitRootLogin no` and, after key enrollment, `PasswordAuthentication no`. - Use SSH public-key authentication for remote administration. - Until credentials are rotated, connect the device only to an isolated provisioning network or directly to a trusted workstation. - Review the `sunrise` account's `sudo` configuration and remove unnecessary passwordless administrative privileges. - Recommend firewall rules that restrict management services to trusted source addresses. - Where supported, force password replacement on first login using account-expiration controls such as: ```bash sudo passwd root sudo passwd sunrise sudo chage -d 0 sunrise ``` - Clarify which account is present on each supported image version rather than encouraging users to try multiple universal credential pairs. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Chaining Abuse

High

• Category: Tool Misuse

Content

## Step 5: 更新系统（推荐）

```bash
sudo apt update && sudo apt upgrade -y
```

## Step 6: 运行第一个 AI Demo

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

1. 从 [地瓜机器人官网](https://developer.d-robotics.cc/) 下载最新 RDK OS 镜像
2. 使用 balenaEtcher 或 `dd` 烧录到 microSD 卡（≥16GB）：
```bash
sudo dd if=rdk_os_image.img of=/dev/sdX bs=4M status=progress && sync
```
3. 插入 SD 卡到 RDK X5

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

1. 从 [地瓜机器人官网](https://developer.d-robotics.cc/) 下载最新 RDK OS 镜像
2. 使用 balenaEtcher 或 `dd` 烧录到 microSD 卡（≥16GB）：
```bash
sudo dd if=rdk_os_image.img of=/dev/sdX bs=4M status=progress && sync
```
3. 插入 SD 卡到 RDK X5

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: Publishing default credentials without an immediate requirement to change them leaves first-boot systems exposed to trivial compromise, especially once they obtain a DHCP address on a local network. In a quickstart context, beginners may treat these credentials as acceptable defaults and never rotate them, enabling unauthorized local or remote access.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ip addr show eth0

# 连接 WiFi
sudo nmcli device wifi connect "你的WiFi名" password "你的密码"

# 确认联网
ping -c 2 baidu.com

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Passing the Wi-Fi password directly on the command line can expose it through shell history, terminal scrollback, logs, or process inspection by other local users. In a beginner quickstart, users are likely to copy-paste the command verbatim, increasing the chance that sensitive credentials are stored or disclosed unintentionally.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest says this skill should not be used for firmware upgrade or advanced system management and directs those tasks to rdk-x5-system. However, the body includes a dedicated '更新系统（推荐）' step with `apt update && apt upgrade -y`, which goes beyond initial onboarding and overlaps with system-management behavior excluded by the manifest.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest explicitly says this skill should not be used for TROS development and points users to `rdk-x5-tros`. Yet Step 6B instructs users to source a TROS environment and launch a ROS2/TROS demo pipeline, which materially overlaps with the excluded TROS scope.

Static analysis

No suspicious patterns detected.