T03 · Remote Payload Retrieval and Execution
Error
- Location
USAGE-GUIDE.md:49- Finding
Unverified Remote Script Is Executed with Root Privileges
- Content
View full analysis
- Remediation
View remediation
Security audit
Usb Light Sensor Reader
Security checks for vulnerabilities and agentic risk
Overview
The sensor code itself is read-only, but the bundled guide expands it into AI-controlled USB relay operation and includes unsafe privileged installation steps, so it should be reviewed before installation.
Install only if you intend to grant an agent serial-device access and you understand the relay-control examples can switch real connected equipment. Review or remove the combined relay automation guide, avoid the curl-to-sudo installer pattern, pin CLI and dependency versions, and independently inspect the external control-usb-relay and NanoBot components before using them with hardware.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
USAGE-GUIDE.md:8- Finding
Unpinned Third-Party Packages and Skills Create a Mutable Supply Chain
- Content
View full analysis
=3.5 ``` Additional installation paths repeat the same issue: ```bash pip3 install pyserial pip3 install --user pyserial ``` ```bash git clone https://github.com/nanobot-ai/nanobot.git cd nanobot pip3 install -r requirements.txt # Or install via pip pip3 install nanobot-ai ``` ### Technical Analysis The installation procedures do not pin exact reviewed versions, validate package hashes, use a lockfile, or pin the cloned Git repository to a reviewed commit. The `pyserial>=3.5` constraint explicitly permits future releases that did not exist at audit time. Package installation can execute package build logic, npm lifecycle scripts, or imported installation tooling. Installing another ClawHub skill also adds code that is not part of the audited project. The global npm installation further places executable package content into a broadly accessible system or user environment. No evidence establishes that the currently named packages are malicious. The confirmed issue is that the documented process trusts mutable third-party content and therefore cannot guarantee that users install the versions reviewed or intended by the project. ### Attack Path 1. A user follows ...[truncated 1264 chars]- Remediation
View remediation
=3.5` with an exact compatible version and maintain upgrades through a controlled review process. - Generate and commit lockfiles containing resolved transitive versions. - Use hash-verified installation, such as pip requirements containing `--hash` entries and npm lockfiles with integrity metadata. - Pin cloned repositories to a full reviewed commit hash rather than installing from the default branch. - Audit `control-usb-relay` and NanoBot independently before recommending them. - Use isolated Python virtual environments and project-local npm installations instead of global installation. - Restrict package indexes and registries to approved sources, and enable provenance or signature verification where supported. - Disable package lifecycle scripts when they are not required. - Document an explicit dependency-update process that includes source review, vulnerability scanning, integrity regeneration, and regression testing. ]]>
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
USAGE-GUIDE.md:14- Finding
Documentation Expands a Read-Only Sensor Skill into Unreviewed Physical Relay Control
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (38)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
This line chains network retrieval directly into a privileged shell, combining multiple dangerous actions into a single opaque command. That removes opportunities for inspection and allows a compromised upstream source to achieve immediate root-level code execution, making the exploit path exceptionally severe.
- Content
bash # Ubuntu/Debian curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - sudo apt-get install -y nodejs # Verify installation
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The 'Expected AI Action' example for this skill imports and controls a USB relay, directly encouraging physical actuation from within a sensor-oriented workflow. This can mislead agents into performing high-consequence hardware operations under the guise of a read-only capability.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The scheduled-operation example documents autonomous device actuation based on sensor readings over time, enabling unattended hardware control. In agent contexts, this is dangerous because it normalizes persistent physical automation without explicit safeguards, supervision, or fail-safe conditions.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
The guide encourages updating installed skills in place, which is a self-modification pathway for agent capabilities. Without pinning, review, or trust verification, updates can silently change behavior and introduce malicious code that persists across sessions.
- Content
md npx clawhub inspect control-usb-relay npx clawhub inspect usb-light-sensor-reader # Update skills npx clawhub update control-usb-relay npx clawhub update usb-light-sensor-reader
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The installation command uses
npx clawhubwithout pinning a specific version, which means users may execute whatever package version is current at install time. This creates a supply-chain risk: a compromised upstream package, typo-squat, or malicious update could cause arbitrary code execution on the user's machine during installation.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The usage guide for a light-sensor skill is broadened to cover USB relay control and combined automations, expanding the operational scope beyond passive sensing. This scope blending increases the chance that an agent or user treats the sensor skill as implicitly authorized to perform device actuation.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The guide instructs users to execute
npx clawhubwithout pinning a specific version, which means code is fetched and run from the package registry at invocation time. If the package is updated maliciously, compromised, or a dependency is hijacked, users may execute unreviewed code in their environment.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This command uses unpinned
npx clawhub, causing runtime retrieval of the latest package version. That creates a supply-chain execution path where a compromised upstream release could run arbitrary code on the user's machine.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Invoking
npx clawhub install usb-light-sensor-readerwithout a pinned version trusts whatever version is current in the registry. In a setup guide for hardware-integrated agent skills, that exposes users to remote code execution via package substitution or malicious updates.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide discusses powering connected devices through a relay but does not include prominent warnings about physical effects, load limits, or the risk of energizing equipment unexpectedly. In a hardware-control context, omission of such warnings materially increases misuse risk.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The use of
sudo -Ewhile executing a remote script as root preserves environment variables into a privileged context, which can enable environment-based manipulation in addition to the core remote-script risk. Combined with the pipe-to-bash pattern, this significantly raises exploitation potential.- Content
bash # Ubuntu/Debian curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - sudo apt-get install -y nodejs # Verify installation
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The use of
sudo -Ewhile executing a remote script as root preserves environment variables into a privileged context, which can enable environment-based manipulation in addition to the core remote-script risk. Combined with the pipe-to-bash pattern, this significantly raises exploitation potential.- Content
bash # Ubuntu/Debian curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - sudo apt-get install -y nodejs # Verify installation
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - sudo apt-get install -y nodejs # Verify installation node --version
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - sudo apt-get install -y nodejs # Verify installation node --version
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The version check still executes
npx clawhubfrom the registry without an exact version, which can trigger installation or execution of untrusted code. Even seemingly harmless verification commands can become an attack vector in supply-chain compromise scenarios.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The login command relies on unpinned
npx clawhub, allowing unreviewed package code to run before authentication and potentially intercept tokens or credentials. This is especially sensitive because it is tied to an authentication workflow.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Using unpinned
npx clawhub whoamistill requires trust in the current registry state and can execute attacker-controlled code if the upstream package is compromised. Authentication context increases the potential for account/token theft.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Step 6: Install the Skills
bash # Create skills directory (if not exists) mkdir -p skills cd skills
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The installation command for the relay skill uses unpinned
npx clawhub, creating a supply-chain execution risk. Because the installed skills are later used for hardware interaction, compromise could extend to persistent malicious automation or device control.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This command installs the light-sensor skill through an unpinned
npxinvocation, exposing users to arbitrary upstream code execution. The guide normalizes direct install-and-run behavior without provenance controls.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
Although
npx clawhub listis less sensitive than install/login, it still executes an unpinned package and therefore inherits supply-chain risk. Any command that triggers package resolution can be abused if the registry package is compromised.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented behavior explicitly directs the light-sensor context into relay/device control automation. For agent-integrated skills, this encourages privilege expansion from reading environmental data to taking physical actions, which can be unsafe if user intent is ambiguous or permissions are broader than expected.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
These automation examples enable continuous autonomous relay switching based on sensor values without any warning about unattended operation, oscillation, or harm to connected devices. The context makes this more dangerous because it combines AI-driven decision-making with physical actuation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The status-check example combines sensor reads with relay state inspection, further blurring the boundary between a sensing skill and a hardware control skill. While read-only relay status is less severe than actuation, it still expands perceived capabilities and can be used as a stepping stone to control logic.
- Content
Static analysis
No suspicious patterns detected.