ClawHub
Back to skill

Security audit

Raspberry Pi I2C Sensor Development

Security checks for vulnerabilities and agentic risk

Overview

This Raspberry Pi sensor guide is mostly coherent, but it includes an overbroad privileged command that could disrupt unrelated Python services.

Install only if you are comfortable reviewing hardware commands before running them. Avoid `sudo killall python3`; identify the specific process holding the GPIO or I2C device and stop only that process. Prefer a virtual environment and pinned dependency versions for Python packages.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:132
Finding

Unpinned Third-Party Python Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 132
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Complete Code Snippet:

bash
pip3 install gpiod

Technical Analysis

The installation command does not pin gpiod to a reviewed version and does not verify package integrity through cryptographic hashes. Consequently, the installed code depends on mutable package-index state at the time the command is run.

Python package installation can execute package-controlled build or installation logic. If the selected package release or configured package index is compromised, following this instruction could execute attacker-controlled code. The issue is not triggered merely by loading the Skill; the user must run the documented command.

Attack Path

  1. An attacker compromises a future gpiod release, the configured Python package index, or the dependency-resolution path.
  2. A user follows the Skill and runs pip3 install gpiod.
  3. pip resolves and downloads the mutable, unverified package artifact.
  4. Package-controlled installation or build code executes locally.
  5. The malicious package operates with the privileges of the account that invoked pip3 and may remain available to applications that import it.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the invoking user's privileges. The accessible scope may include that user's files, environment variables, application data, hardware interfaces available to the account, and network access. This instruction does not use sudo, so it does not directly grant root privileges.

Remediation
View remediation

Remediation Suggestions

  • Pin gpiod to a specifically reviewed and tested version.
  • Distribute a lock file or requirements file that includes cryptographic hashes, and install it with pip install --require-hashes.
  • Document the expected trusted package index and avoid untrusted mirrors.
  • Install the dependency inside a dedicated virtual environment with only the permissions required for GPIO access.
  • Periodically review and deliberately update the pinned version rather than accepting an uncontrolled latest release.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:383
Finding

Overbroad Privileged Termination of Python Processes

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 383
Vulnerability Type: Unsafe process-management guidance
Risk Level: Medium

Complete Code Snippet:

text
| "Device or resource busy" | GPIO is occupied by another process | `sudo killall python3` or release the gpiod line |

Technical Analysis

The troubleshooting instruction recommends running killall through sudo. The command selects processes solely by the executable name python3, rather than identifying the process that owns the relevant GPIO resource. With elevated privileges, it can terminate Python processes belonging to other users and system services.

This violates least-disruption and least-privilege principles. Resource contention should be resolved by identifying the exact holder of /dev/gpiochip0 or the relevant GPIO line and terminating only that process after verification.

Attack Path

  1. The user encounters a Device or resource busy error while accessing GPIO.
  2. The user follows the documented troubleshooting instruction and executes sudo killall python3.
  3. Root-authorized killall selects every process named python3 that it can reach.
  4. Unrelated Python applications, background jobs, monitoring agents, or services are terminated.
  5. Affected services remain unavailable until they are restarted, and unsaved in-memory state may be lost.

This is primarily a destructive operational path rather than a path to attacker-controlled code execution.

Impact Assessment

The command can disrupt Python processes system-wide because it runs with root authorization. Potential consequences include denial of service, interruption of unrelated workloads, loss of unsaved data, and termination of monitoring or security automation. It does not itself provide an attacker with an interactive root shell or persistent access.

Remediation
View remediation

Remediation Suggestions

  • Remove sudo killall python3 from the troubleshooting instructions.
  • Identify the exact resource holder with a targeted command such as lsof /dev/gpiochip0 or fuser /dev/gpiochip0.
  • Display and verify the owning PID, user, and command before taking action.
  • Request graceful termination of only the confirmed process, using the owning account and avoiding sudo where possible.
  • Use forced termination only as a last resort after confirming that graceful shutdown failed.
  • Prefer releasing the acquired gpiod line through proper application cleanup, context managers, signal handlers, or finally blocks.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 390)May include surrounding context.

md
| 现象 | 原因 | 解决 |
|------|------|------|
| `No module named 'bmi270'` | sudo 使用 root 的 Python path | 不用 sudo 运行 Flask，或设置 PYTHONPATH |
| gpiod 权限不足 | 用户不在 gpio 组 | `sudo usermod -aG gpio ubuntu` |
| SMBus monkey-patch 不生效 | 导入顺序问题 | 必须先 patch `sys.modules` 再 import BMI270 |

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description and the entire skill content are presented in Chinese, which imposes a specific language on users. The file does not offer an opt-in choice of language or explain that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

bash
# 启用
sudo raspi-config  # -> Interface Options -> I2C -> Enable
# 或修改 /boot/config.txt 添加：
# dtparam=i2c_arm=on

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

bash
# 启用
sudo raspi-config  # -> Interface Options -> I2C -> Enable
# 或修改 /boot/config.txt 添加：
# dtparam=i2c_arm=on

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 362)May include surrounding context.

md
|--------|------|
| I2C 是否启用？ | `ls /dev/i2c-*` 应有 `/dev/i2c-1` |
| 设备是否上电？ | 万用表量 VCC/GND 之间是否有 3.3V |
| 地址是否正确？ | `sudo i2cdetect -y 1` 扫描总线 |
| 接线是否松动？ | SDA/SCL 是否反接？ |
| 上拉电阻？ | GPIO2/GPIO3 有板载上拉，其他 GPIO 需外接上拉或 gpiod 内部上拉 |
| 设备是否被占用？ | `lsof /dev/i2c-1` 检查是否有其他进程占用 |

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 390)May include surrounding context.

md
|--------|------|
| I2C 是否启用？ | `ls /dev/i2c-*` 应有 `/dev/i2c-1` |
| 设备是否上电？ | 万用表量 VCC/GND 之间是否有 3.3V |
| 地址是否正确？ | `sudo i2cdetect -y 1` 扫描总线 |
| 接线是否松动？ | SDA/SCL 是否反接？ |
| 上拉电阻？ | GPIO2/GPIO3 有板载上拉，其他 GPIO 需外接上拉或 gpiod 内部上拉 |
| 设备是否被占用？ | `lsof /dev/i2c-1` 检查是否有其他进程占用 |

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 391)May include surrounding context.

md
|--------|------|
| I2C 是否启用？ | `ls /dev/i2c-*` 应有 `/dev/i2c-1` |
| 设备是否上电？ | 万用表量 VCC/GND 之间是否有 3.3V |
| 地址是否正确？ | `sudo i2cdetect -y 1` 扫描总线 |
| 接线是否松动？ | SDA/SCL 是否反接？ |
| 上拉电阻？ | GPIO2/GPIO3 有板载上拉，其他 GPIO 需外接上拉或 gpiod 内部上拉 |
| 设备是否被占用？ | `lsof /dev/i2c-1` 检查是否有其他进程占用 |

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
86% confidence
Finding

Recommending sudo killall python3 as a generic remediation is dangerous because it can terminate unrelated Python processes running as root or critical services on the device. On shared or production systems, this can cause denial of service and unintended disruption far beyond the GPIO troubleshooting scope.

Content

Scanner excerpt · SKILL.md (reported line 383)May include surrounding context.

md
|------|------|------|
| 设备偶尔 ACK 失败 | SDA 切换输出/输入时序不对 | 确保 SDA 在 SCL 低电平时切换 |
| 完全无响应 | 缺少上拉电阻 | gpiod 必须带 `BIAS_PULL_UP` 标志 |
| "Device or resource busy" | GPIO 被其他进程占用 | `sudo killall python3` 或释放 gpiod line |
| 速度太慢 | usleep 粒度大 | 树莓派 Linux 下 `usleep(10)` 实际约 60-100us |

### 6.4 Flask / Python 特定问题

Static analysis

No suspicious patterns detected.