ClawHub
Back to skill

Security audit

codesys-toolkit

Security checks across malware telemetry and agentic risk

Overview

This PLC automation skill is coherent, but it deserves review because it can terminate active InoProShop sessions and overwrite or modify PLC project/workspace files from configurable paths.

Review this before installing in any real PLC engineering environment. Use it only on backed-up or version-controlled project workspaces, verify every env.json path before running export, patch, generate, or check, prefer the fixed launcher aliases over arbitrary script paths, and use -NoKill when an active InoProShop session may contain unsaved work.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tainted flow: '_template' from open (line 35, file read) → shutil.copy (file write)

Medium
Category
Data Flow
Content
# ── 复制模板（先删旧文件避免只读属性冲突） ──
if os.path.exists(_new_project):
    os.remove(_new_project)
shutil.copy(_template, _new_project)
log(u'Copied template -> ' + _new_project)

# ── 打开工程，置询等待加载（最长 30s） ──
Confidence
89% confidence
Finding
shutil.copy(_template, _new_project)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The script accepts an arbitrary absolute path or skill-relative path and passes it directly to InoProShop via /runscript, enabling execution of unintended Python code. In this skill context, that is especially risky because the launcher is presented as a general-purpose entry point and also sets inherited environment state, so a user or downstream component can run attacker-controlled scripts outside the intended fixed aliases.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation describes patch and generate workflows that modify CODESYS/InoProShop project artifacts, but it does not clearly warn users that these operations can overwrite project state or make irreversible changes. In an industrial automation context, insufficient disclosure increases the chance of accidental misuse, loss of engineering work, or deployment of unintended PLC logic.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The launcher is documented as killing existing InoProShop processes, but the quick-start and tool summary do not prominently warn that invoking the script may terminate a live engineering session. In a PLC engineering environment, unexpected process termination can cause unsaved work loss, interrupted maintenance, or unsafe operator assumptions about tool behavior.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The script unconditionally calls shutil.rmtree(_st_dir) and recreates the directory, which can destroy existing data if workspace_dir is misconfigured or points somewhere unintended. In this skill context, workspace_dir is externally supplied configuration, so a bad value could lead to destructive deletion outside the expected export area.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The script deletes files under paths derived from `workspace_dir` and overwrites the target project file with no path safety checks, confirmation, or containment to a known-safe workspace root. In an agent skill context where configuration can be influenced externally, this increases the risk of destructive file operations against unintended locations if `workspace_dir` is misconfigured or maliciously set.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.