Security audit

xgorobot

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent XGO robot controller, but it includes unsafe shell execution and under-disclosed privileged hardware commands that need review before installation.

Install only after review or remediation. The core robot-control purpose is clear, but users should avoid untrusted URLs, filenames, and target text, should expect camera/audio data to be sent to DashScope for AI features, and should remove shell=True/os.system patterns and sudo-backed helper calls before using this on a real robot.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/audio/play_http.py:14
Finding: Shell Command Injection Through an Untrusted Audio URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/audio/play.py:13
Finding: Shell Command Injection and Path Traversal Through Local Audio Filename
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/combo/ai_find_step.py:88
Finding: Shell Command Injection Through Target-Derived Speech Text
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ai/text_to_speech.py:61
Finding: Command Injection Through a Network-Provided Text-to-Speech Audio URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: lib/edulib.py:419
Finding: Unsafe Shell-Backed Media and Recording Methods in the Shared Library
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: lib/edulib.py:194
Finding: Implicit Privileged GPIO Operations Violate Least Privilege
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (173)

Tainted flow: 'audio_url' from requests.post (line 61, network input) → subprocess.run (code execution)

Critical

Category: Data Flow
Confidence: 99% confidence
Finding: There is a direct tainted data flow from requests.post response content to subprocess.run, creating a classic remote-to-code-execution path. Because this runs on a robot control platform, successful exploitation could allow arbitrary commands on the host and potentially affect attached hardware or broader system trust.
Content: Scanner excerpt · scripts/ai/text_to_speech.py (reported line 66)May include surrounding context.
python
edu.lcd_clear() edu.lcd_text(5, 5, "播放中...", "GREEN", 14) subprocess.run(f'mplayer -really-quiet "{audio_url}"', shell=True, check=True) print(f"语音合成完成: {args.text}") print(f"音色: {args.voice} ({VOICE_OPTIONS.get(args.voice, '')})") else:

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation text is extremely broad, covering generic terms like movement, camera, AI, speech, and detection, which can cause the skill to trigger in many unrelated conversations. Because this skill has shell, network, sensing, and physical actuation implications, overbroad routing materially raises the chance of accidental invocation and unsafe real-world actions.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.
md
| `take_photo.py` | 拍照 | `--filename photo.jpg` | 照片已保存: {path} |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.
md
| `camera_preview.py` | 摄像头预览 | `--duration 10` | 预览窗口显示 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.
md
| `face_detect.py` | 人脸检测 | `--continuous` (持续模式) | 检测到人脸: x=, y=, w=, h= 或未检测到人脸 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.
md
| `face_count.py` | 人脸计数 | 无 | 共检测到 N 张人脸 + 每张人脸位置 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.
md
| `gesture_detect.py` | 手势识别 | `--continuous` | 识别到手势: {手势} 位置=({x},{y}) 或无 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.
md
| `color_detect.py` | 颜色识别 | `--color R` (R/G/B/Y) `--continuous` | 检测到{颜色}: 位置=({x},{y}), 半径={r} |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.
md
| `line_detect.py` | 巡线检测 | `--color K` (K黑/W白/R/G/B/Y) `--continuous` | 巡线: x={x}, angle={角度} |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.
md
| `qr_scan.py` | 二维码扫描 | `--continuous` | 二维码内容: {内容} 或无 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.
md
| `yolo_detect.py` | 目标检测 | `--continuous` | 检测到: {类别} 位置=({x},{y}) 或无 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.
md
| `emotion_detect.py` | 情绪识别 | `--continuous` | 情绪: {情绪} 位置=({x},{y}) 或无 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.
md
| `find_ball.py` | 寻找小球 | `--color R` `--timeout 30` | ✓ 找到{颜色}色小球或 ✗ 超时未找到 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.
md
| `find_person.py` | 寻找人类 | `--timeout 45` | ✓ 找到人类或 ✗ 超时未找到 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.
md
| `catch_ball.py` | 抓取小球 | `--color R` `--timeout 60` | ✓ 抓取成功或 ✗ 抓取失败 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.
md
| `read_imu.py` | 读取IMU | `--axis all` (roll/pitch/yaw/all) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.
md
| `read_motor.py` | 读取舵机角度 | 所有舵机当前角度 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.
md
| `move.py` | 前后移动 | `--speed 0.5` `--runtime 3` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 286)May include surrounding context.
md
| `roll.py` | Roll姿态 | `--angle 10` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.
md
| `height.py` | 身高调整 | `--height 90` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.
md
| `reset_odom.py` | 重置里程计 | 无参数 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.
md
| `balance_roll.py` | Roll自平衡 | `--mode 1` (0=关, 1=开) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 296)May include surrounding context.
md
| `perform.py` | 表演模式 | `--mode 1` (0=关, 1=开) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.
md
| `calibration.py` | 软件标定 | `--state start/end` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.
md
| `periodic_roll.py` | 周期Roll | `--period 1.5` `--duration 5` |