Security audit

郑州科威莱步进电机控制器调试助手-雄安素水公司编写

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed stepper-motor controller helper, but it can move connected hardware and change controller settings.

Install only if you intend to work with this specific stepper motor controller. Treat write operations and movement helpers as live hardware actions: verify wiring, port, device address, limits, travel bounds, and emergency-stop access before running them, and avoid arbitrary register writes on production equipment without operator review.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly states that all code supports reading or writing any register, including registers for motion start, emergency stop, homing, direction, and origin setting, but it does not provide an explicit safety warning about unintended physical movement or machine state changes at the point of use. In an industrial control context, this can cause unsafe motion, incorrect homing, loss of calibration, or equipment damage if a user invokes generated code without safeguards, confirmation, or operating constraints.

Static analysis

No suspicious patterns detected.