Control Usb Relay

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:43 AM UTC
• Version: 1.0.2

Overview

The skill does what it claims, but its setup and test instructions can run high-impact commands and physically switch connected equipment without enough safeguards.

Review carefully before installing. Do not run `python3 relay.py` with a real load attached unless you are prepared for the relay to switch and possibly remain on. Use low-voltage test loads first, add physical safety controls, avoid safety-critical or mains-powered equipment unless properly rated and installed, and prefer pinned, verified installation commands instead of pipe-to-sudo or floating latest packages.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: USAGE-GUIDE.md:55

Finding

Unverified Remote Script Is Executed with Root Privileges

Content

View full analysis

Vulnerability Details

File Location: USAGE-GUIDE.md:55
Vulnerability Type: Remote payload retrieval and privileged execution
Risk Level: High

Vulnerable Code

bash

curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -

Technical Analysis

The installation guide pipes content retrieved from an external URL directly into a root shell. The downloaded script is mutable and is not authenticated using a pinned checksum, package signature, or locally reviewed copy before execution.

Although HTTPS provides transport protection, it does not make the remotely served script immutable. Compromise of the remote distribution infrastructure, its account, the delivery chain, or a trusted certificate path could cause different commands to be returned after the Skill has been reviewed. The use of sudo -E bash gives those commands root privileges and preserves parts of the invoking user's environment.

This creates a direct remote-code-execution channel whose effective payload is controlled outside the audited project.

Attack Path

1. A user follows the Node.js installation instructions in USAGE-GUIDE.md.
2. The command retrieves the current response from https://deb.nodesource.com/setup_lts.x.
3. An attacker who compromises or gains control over the remote response inserts arbitrary shell commands.
4. The response is passed directly to bash without inspection or integrity verification.
5. sudo executes the attacker-controlled commands with root privileges.
6. The attacker can modify system files, install services, access locally available data, or establish persistence.

Impact Assessment

Successful exploitation provides arbitrary command execution as root. The affected scope is the entire host rather than only the Skill directory or serial device. Potential consequences include system takeover, credential theft, installation of persistent malware, modification of security c ...[truncated 201 chars]

Remediation

View remediation

Remediation Suggestions

• Do not pipe network responses directly into a shell, particularly a privileged shell.
• Prefer distribution-supported Node.js packages or a repository configured through documented package-manager operations.
• If an external setup artifact is unavoidable, download a fixed version to disk first.
• Pin the expected version and verify a publisher signature or a securely distributed cryptographic checksum before execution.
• Inspect and execute the verified local file as a separate step.
• Avoid preserving the user's environment with sudo -E unless specific variables are strictly required and validated.
• Document the exact trusted source, expected digest, and key fingerprint so installation is reproducible and auditable.

T09 · Insecure Skill Coding Practices

Error

• Location: relay.py:141

Finding

Documented Test Automatically Actuates Hardware and Leaves the Relay On

Content

View full analysis

Vulnerability Details

File Locations: setup.md:18-19, relay.py:141-165
Vulnerability Type: Unsafe physical-device test behavior
Risk Level: High

Vulnerable Code

The setup guide directs the user to execute the module as a test:

bash

# Test relay
python3 relay.py

The module entry point automatically performs several physical switching operations:

python

if __name__ == "__main__":
    # Test example
    relay = Relay()

    if relay.connect():
        print("Relay connected successfully")

        print("Turning ON relay...")
        relay.turn_on()
        time.sleep(1)

        print("Turning OFF relay...")
        relay.turn_off()
        time.sleep(1)

        print("Toggling relay...")
        relay.toggle()
        time.sleep(1)

        print(f"Current state: {'ON' if relay.get_status() else 'OFF'}")

        relay.disconnect()
        print("Relay disconnected")

Technical Analysis

Running the documented test immediately actuates the connected relay without requiring an explicit operation argument or interactive confirmation. The sequence turns the relay on, turns it off, and then calls toggle().

Because the in-memory state is set to False after turn_off(), the final toggle() calls turn_on(). The program then disconnects from the serial port without issuing another off command. Disconnecting the serial interface does not reverse the relay's last physical state, so the attached circuit can remain energized after the test exits.

This behavior conflicts with the Skill's stated security rule that the user should be consulted before switching physical equipment. It is particularly unsafe because the command is presented as a generic connectivity test rather than an actuation test.

The code also lacks a try/finally cleanup path. An interruption or exception after the first turn_on() can therefore leave the relay energized and the ser ...[truncated 1193 chars]

Remediation

View remediation

Remediation Suggestions

• Make the default module entry point non-actuating; it should report usage or perform a passive serial-port check.
• Require an explicit operation such as --on, --off, or --actuation-test.
• Require interactive confirmation immediately before any physical switching operation unless the user has explicitly selected a documented noninteractive automation mode.
• Clearly warn that the test will energize attached equipment.
• Remove the final toggle from the test or explicitly issue turn_off() before exit.
• Place shutdown and disconnect operations in a finally block.
• Check and handle the return value from every relay operation.
• Consider a fail-safe context manager that attempts to turn the relay off before closing the serial port.
• State clearly that software shutdown cannot replace appropriate electrical interlocks, fusing, emergency stops, or load-rated switching hardware.

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Overly Broad Third-Party Installation Chain

Content

View full analysis

Vulnerability Details

File Locations: requirements.txt:1, USAGE-GUIDE.md:13-23, USAGE-GUIDE.md:62-63, USAGE-GUIDE.md:80-81, USAGE-GUIDE.md:96-112
Vulnerability Type: Unpinned third-party dependencies and unnecessary supply-chain expansion
Risk Level: Medium

Vulnerable Code

The Python dependency permits any future compatible release:

text

pyserial>=3.5

The user guide also installs mutable latest versions of several external tools and packages:

bash

npm install -g clawhub

bash

pip3 install pyserial

# Or for specific user
pip3 install --user pyserial

bash

# Install USB Relay Control skill
npx clawhub install control-usb-relay

# Install USB Light Sensor Reader skill
npx clawhub install usb-light-sensor-reader

bash

# Clone NanoBot repository
git clone https://github.com/nanobot-ai/nanobot.git
cd nanobot

# Install dependencies
pip3 install -r requirements.txt

# Or install via pip
pip3 install nanobot-ai

Technical Analysis

The project does not use exact dependency versions, hashes, a lockfile, a pinned Git commit, or another reproducible integrity mechanism. Consequently, identical installation commands can resolve to different code over time.

Package installation can execute package build or installation logic under the invoking user's account. A compromised publisher account, malicious future release, compromised transitive dependency, or repository takeover could therefore introduce code not present during this audit.

The installation guide additionally expands the trusted computing base beyond what is needed for direct USB relay control. NanoBot and the separate light-sensor Skill are optional integrations, but they are presented in the primary installation path. Global npm installation further broadens the filesystem locations and execution paths affected by the package.

No evidence was found that the curren ...[truncated 1397 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each direct dependency to an exact reviewed version rather than using >=.
• Generate and retain a lockfile that captures transitive dependencies.
• Use hash-verified installation, such as pip requirements containing --hash values and installation with --require-hashes.
• Pin Git-based installation instructions to a reviewed commit or signed release tag instead of the default branch.
• Pin npm and ClawHub package versions and use available lockfile or integrity-verification mechanisms.
• Separate the minimal relay installation from optional NanoBot and light-sensor integration instructions.
• Avoid global npm installation where a project-local installation or isolated execution environment is sufficient.
• Install Python packages in a dedicated virtual environment rather than the system interpreter.
• Review dependency provenance and transitive dependency changes before updating pinned versions.
• Document a controlled update process that includes security review and integrity verification.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (34)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This line chains a network fetch directly into privileged execution, collapsing download, trust decision, and execution into a single step. That makes review impossible and significantly increases the blast radius of any upstream compromise, typo, or interception.

Content

Scanner excerpt · USAGE-GUIDE.md (reported line 69)May include surrounding context.

bash

# Ubuntu/Debian
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
sudo apt-get install -y nodejs

# Verify installation

Self-Modification

High

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The guide explicitly recommends updating installed skills from a remote source. In a skill ecosystem, self-modification is risky because it can alter agent capabilities after initial review, and here the affected skill can control physical hardware, increasing the consequences of a malicious update.

Content

Scanner excerpt · USAGE-GUIDE.md (reported line 470)May include surrounding context.

md

npx clawhub inspect control-usb-relay
npx clawhub inspect usb-light-sensor-reader

# Update skills
npx clawhub update control-usb-relay
npx clawhub update usb-light-sensor-reader

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This skill controls physical relay hardware that can switch attached equipment, but the README presents on/off and automation behavior without an upfront safety warning about energizing real-world devices. In a hardware-control context, omission of such warnings can lead to unsafe deployment, unintended actuation, or damage when users connect mains-powered or safety-sensitive loads.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx clawhub install control-usb-relay without pinning a specific version. That causes execution of whatever package/version is current at install time, increasing supply-chain risk if the package is updated maliciously, compromised, or unexpectedly changed.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 91)May include surrounding context.

md

| Issue | Solution |
|-------|----------|
| No click sound | Verify protocol matches your device |
| `Permission denied` | Run `sudo usermod -a -G dialout $USER`, then logout/login |
| `Connection failed` | Check `ls /dev/ttyUSB*` for device |
| Relay doesn't stay | Check external power supply |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · USAGE-GUIDE.md (reported line 437)May include surrounding context.

md

| Issue | Solution |
|-------|----------|
| No click sound | Verify protocol matches your device |
| `Permission denied` | Run `sudo usermod -a -G dialout $USER`, then logout/login |
| `Connection failed` | Check `ls /dev/ttyUSB*` for device |
| Relay doesn't stay | Check external power supply |

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The guide instructs users to run npx clawhub without pinning a specific package version. npx can fetch and execute the latest published package, which creates supply-chain risk if a malicious or compromised release is published later. Because these commands are presented as installation and login steps, users may execute them with high trust.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This command invokes npx clawhub install control-usb-relay without pinning the CLI version. An unpinned executable fetched at runtime can change behavior over time or be replaced by a compromised upstream release, enabling arbitrary code execution during install.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The same unpinned npx supply-chain risk applies to installing usb-light-sensor-reader. Since the command may retrieve the latest CLI code and potentially install remote skill content, compromise of the distribution channel could lead to arbitrary code execution or malicious skill deployment.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The sudo -E form is particularly dangerous because it preserves environment variables when invoking a root shell on remote script content. This can allow environment-based manipulation or leakage in addition to the already severe pipe-to-shell risk, making exploitation easier in compromised environments.

Content

Scanner excerpt · USAGE-GUIDE.md (reported line 69)May include surrounding context.

bash

# Ubuntu/Debian
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
sudo apt-get install -y nodejs

# Verify installation

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The sudo -E form is particularly dangerous because it preserves environment variables when invoking a root shell on remote script content. This can allow environment-based manipulation or leakage in addition to the already severe pipe-to-shell risk, making exploitation easier in compromised environments.

Content

Scanner excerpt · USAGE-GUIDE.md (reported line 69)May include surrounding context.

bash

# Ubuntu/Debian
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
sudo apt-get install -y nodejs

# Verify installation

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · USAGE-GUIDE.md (reported line 70)May include surrounding context.

bash

# Ubuntu/Debian
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
sudo apt-get install -y nodejs

# Verify installation
node --version

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · USAGE-GUIDE.md (reported line 111)May include surrounding context.

bash

# Ubuntu/Debian
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
sudo apt-get install -y nodejs

# Verify installation
node --version

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

npx clawhub --version still executes the package resolver and may fetch the latest package if not installed locally. Even a seemingly harmless version check can trigger execution of attacker-controlled code if the package source is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The login step uses unpinned npx, exposing users to supply-chain compromise at the moment they authenticate. If the fetched package is malicious, it could steal credentials, browser tokens, or redirect users to phishing flows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

npx clawhub whoami has the same unpinned execution risk as other CLI calls. Because it likely interacts with stored auth state, a malicious package version could exfiltrate tokens or local configuration.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · USAGE-GUIDE.md (reported line 121)May include surrounding context.

Step 6: Install the Skills

bash

# Create skills directory (if not exists)
mkdir -p skills
cd skills

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The installation flow again relies on unpinned npx clawhub install, which may execute attacker-controlled upstream code. This is particularly risky because it is framed as a normal setup step and may cause users to install additional remote content with minimal scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This command repeats the unpinned runtime package execution pattern for another skill installation. If the package ecosystem or registry account is compromised, users can receive malicious code during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Even npx clawhub list can trigger package resolution and execution of the latest CLI code. The repeated documentation pattern normalizes unsafe package execution and increases exposure across multiple workflow steps.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The usage guide provides multiple relay-control examples that physically switch connected devices but does not include a safety warning about energizing external equipment. In this context, the skill directly interfaces with hardware, so omission of warnings increases the chance of unsafe activation, damage to attached devices, or hazardous real-world behavior from an agent following examples verbatim.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

npx clawhub inspect control-usb-relay is another unpinned CLI execution path. Because users may run it to inspect trustworthiness, a compromised package here is especially problematic: the verification step itself can become the attack vector.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This is the same unpinned npx issue for inspecting the companion skill. Users are encouraged to trust output from code they fetched and executed at runtime, which weakens the value of the inspection step.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

npx clawhub update control-usb-relay combines unpinned package execution with self-update behavior. This magnifies supply-chain risk because it both runs the latest CLI and modifies installed skill content, potentially replacing a previously trusted skill with malicious code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.