Security audit

Robotics

Security checks for vulnerabilities and agentic risk

Overview

This robot-control skill is not malicious, but it needs review because it presents live robot movement and IM control without clear safety, authorization, or installer integrity guardrails.

Install only after reviewing the code and preferably from a pinned release or verified commit. Treat any real robot deployment as safety-critical: use a supervised test area, keep emergency stop available, restrict who can send IM commands, protect bot credentials, and add confirmation and motion limits before connecting live hardware.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: README.md:106
Finding: Unpinned npm Package Execution Through the Recommended npx Installation Command
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description centers on controlling robots via instant messaging platforms and specifically mentions Unitree robots and an Insight9 stereo camera. The supplied code only provides abstract IM adapter scaffolding: message models, adapter lifecycle methods, message sending interface, handler registration, and message routing. This is messaging infrastructure, not robot-control logic. While such an adapter could be a supporting component of a robot-control system, this chunk by itself does not substantiate the declared primary purpose or the named integrations, so the description is materially broader and different from the observed behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose centers on controlling robots through IM platforms and supporting specific robotics/camera hardware. The supplied code chunk does not implement any robot-control logic, hardware integration, or camera functionality. Instead, it defines a basic DingTalk adapter with connection state handling and a placeholder message-sending method. This is a materially different primary purpose from the description, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description claims a skill for controlling various mobile robots through IM platforms, specifically mentioning Unitree robots and an Insight9 AI stereo camera. However, the supplied code chunk is only a simple Feishu adapter class with connect/disconnect state handling and a placeholder send_message method. This is not merely a supporting detail if evaluated as the supplied chunk's behavior: its observable purpose is IM adapter plumbing, and it does not demonstrate any robot-control, hardware integration, or camera interaction. Therefore the code chunk does not accurately represent the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says the skill controls various mobile robots through IM platforms and supports specific robotics hardware. However, the supplied code only defines a WeCom messaging adapter with basic connect/disconnect/send_message behavior. There is no robot-control logic, no hardware integration, and no evidence of Unitree or Insight9 support. While a WeCom adapter could be a supporting component of a larger robot-control system, this code chunk itself materially represents messaging infrastructure rather than robot control, so the description does not accurately reflect the actual behavior shown.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says the skill controls various mobile robots through IM platforms and supports specific robotics hardware/software integrations. The provided code chunk does not implement any robot-control behavior or integrations with Unitree robots or Insight9 cameras. Instead, it only defines a simple WhatsApp adapter with configuration fields for phone_number_id and access_token, plus connect/disconnect/send_message stubs. This is a materially different primary purpose from the declared robotics-control functionality, so it is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description emphasizes robot control across multiple robot types and specific hardware/platform support. However, the supplied code chunk contains only foundational sensor abstraction code: an abstract SensorAdapter with connect, disconnect, and get_data methods, plus a SensorData dataclass. This is a generic sensor interface, not robot control logic or concrete support for Unitree robots, IM platforms, or the Insight9 stereo camera. While this could be a supporting component within a larger robotics skill, this chunk's actual behavior does not accurately represent the declared primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The code shown is a minimal package initializer for a module named 'slam', exposing VisualSLAM, Pose, and Navigator. This strongly suggests mapping/localization and navigation functionality. The declared description emphasizes controlling quadruped, bipedal, wheeled, and aerial robots through IM platforms, including named hardware integrations. Those capabilities are not represented in the supplied code. While SLAM/navigation could support robot control in a broader system, this chunk’s primary observable behavior does not match the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared purpose emphasizes controlling robots through IM platforms and supporting specific robot types. The actual code chunk is focused on visual SLAM concepts: maintaining a camera pose, starting/stopping a sensor adapter, and placeholder map operations. This is a materially different primary purpose from robot control. While the mention of Insight9 loosely aligns with the sensor context, the implemented behavior is localization/mapping scaffolding rather than robot control functionality.
Content: No source excerpt is available for this finding.

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · im_adapters/base.py (reported line 48)May include surrounding context.
python
@abstractmethod def send_message(self, user_id: str, message: str) -> bool: """Send message to user""" pass def register_handler(self, handler: Callable[[IMMessage], str]):

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill accepts natural-language commands and can immediately trigger physical robot actions such as movement, turning, standing, and autonomous behaviors without any confirmation, authorization, bounds checking, or safety interlock. In a robotics context, this materially increases the risk of accidental or malicious commands causing physical harm, collisions, or unsafe robot state changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README presents direct physical movement commands like forward 1m, turn left 45, and stand as ready-to-use examples without any safety notice, operator confirmation requirement, or warning about unintended motion. In a robot-control skill, omission of physical-world safety guidance increases the risk of unsafe operation, collisions, injury, and property damage, especially when commands are issued through natural language and messaging platforms.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: The README instructs users to run npx skills add LooperRobotics/OpenClaw-Robotics without pinning a specific version of the package/tooling. This creates a supply-chain risk because users may fetch a changed or compromised package at install time, and in a robotics skill that can bridge into physical device control, compromised installation paths are more dangerous than in a purely informational package.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The quick-start instructions tell users to connect robots to messaging platforms and retrieve status information, but do not warn that control commands and telemetry may traverse third-party IM services. This can expose sensitive operational data, enable interception or account-abuse scenarios, and widen the attack surface for unauthorized robot control if messaging credentials or channels are compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill presents direct movement commands for physical robots (for example, moving forward and turning) without any safety disclaimer, environment checks, authorization model, emergency-stop guidance, or mention of real-world hazards. In a robotics context, normalizing actuation commands without safety framing can lead users to invoke motion in unsafe environments, causing injury, property damage, or loss of control.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The initialize method connects to a robot at a network IP and optionally connects to IM services such as WeCom, Feishu, DingTalk, or WhatsApp, but there is no user-facing warning, logging, or explanatory comment about these outbound connections. This can transmit operational or system data over the network without any explicit disclosure in the code.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description scopes the skill to controlling robots via IM platforms and mentions support for an Insight9 stereo camera, which implies messaging-based robot control. However, this file implements onboard perception and autonomy features by starting VisualSLAM and navigating to spatial goals, which goes beyond straightforward IM-mediated control.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The line "Use English for code and comments" is a natural-language policy constraint that forces a specific language for contributor-authored text. Under the policy, language restrictions should either be optional or clearly justified as region- or compliance-specific, which is not provided here.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: wheel has 4 known advisory(ies) (CVE-2026-24049 (Wheel Affected by Arbitrary File Permission Modification via Path Traversal in w); CVE-2022-40898 (pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)); CVE-2022-40898 (An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlie) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The provided skill manifest describes a skill named 'unitree-robot' that supports Unitree robots and Insight9 AI stereo camera, but this file declares the package as 'openclaw-robotics' and describes support for WeCom, Feishu, DingTalk, and WhatsApp. This creates a semantic mismatch between the claimed skill identity/scope and the codebase metadata being shipped.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: black has 5 known advisory(ies) (CVE-2026-32274 (Black: Arbitrary file writes from unsanitized user input in cache file name); CVE-2024-21503 (Black vulnerable to Regular Expression Denial of Service (ReDoS)); CVE-2024-21503 (Versions of the package black before 24.3.0 are vulnerable to Regular Expression) +2 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The command patterns hard-code Chinese and English trigger phrases, which imposes specific language handling without any explicit user language selection or opt-in. This is a natural-language policy concern because locale behavior is embedded by default rather than being offered as a configurable choice.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The function signature and docstring suggest configurable sensor startup via the sensor parameter, but the implementation ignores that parameter and unconditionally instantiates Insight9Adapter. This creates an intent-code divergence in the API contract and documentation-facing behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.