ClawHub
Back to skill

Security audit

JAKA Robotics Control Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly for controlling JAKA robots, but it gives direct physical motion authority with weak safety checks and should be reviewed carefully before installation.

Install only in a controlled robot environment with trained operators, a clear workcell, reachable emergency stop, reduced-speed testing, and vendor safety controls active. Review or add bounds checks, confirmations, finite-value validation, speed limits, and failure handling before using it on a live robot, and prefer pinned, verified SDK and installer versions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Python SDK Dependency Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14-18
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash
pip install jaka-sdk

Technical Analysis

The installation instructions retrieve and execute the latest available release of jaka-sdk without pinning an audited version or verifying an artifact hash or digital signature. Python package installation can execute package-controlled build logic during installation.

The documented package name also does not clearly correspond to the implementation's import jkrc statement or the separate manual SDK installation process described in README.md. This ambiguity increases the possibility of installing an unintended or similarly named package.

Attack Path

  1. An attacker compromises the referenced package, its publisher account, or the package distribution channel.
  2. Alternatively, a user installs an unintended package because the documented package identity is ambiguous.
  3. The user follows the documented pip install jaka-sdk command.
  4. The package's installation or build logic executes with the user's local privileges.
  5. Malicious code can then access files and resources available to that user, including the robot-control environment.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user performing the installation. The accessible scope may include user files, environment variables, network resources, robot SDK files, and the ability to alter the installed robot-control project. This finding does not demonstrate that the currently referenced package is malicious; it identifies the absence of dependency identity and integrity controls.

Remediation
View remediation

Remediation Suggestions

  • Identify the exact official package and reconcile it with the jkrc module used by the implementation.
  • Pin the dependency to a reviewed, compatible version, such as package==x.y.z.
  • Publish and verify SHA-256 hashes for approved distribution artifacts.
  • Prefer signed SDK artifacts obtained from the official JAKA distribution channel.
  • Install dependencies in an isolated virtual environment under a non-administrative account.
  • Maintain a lock file or internally approved artifact repository for reproducible installation.

T08 · Insecure Dependencies

Warning
Location
README.md:18
Finding

Execution of a Mutable Latest-Version Package Installer

Content
View full analysis

Vulnerability Details

File Location: README.md:18-21
Vulnerability Type: Unpinned executable package
Risk Level: Medium

Vulnerable Code

bash
# 1. 通过 ClawHub 安装技能
npx clawhub@latest install jaka-robotics-control

Technical Analysis

The installation procedure invokes clawhub@latest through npx. The @latest selector allows the executable installer to change after the project has been reviewed. No version constraint, integrity hash, signature verification, or local trust validation is specified.

Because npx downloads and executes package-provided code, compromise of the package, publisher account, registry, or dependency chain could result in local code execution during installation.

Attack Path

  1. An attacker publishes or causes a compromised version to become the package version selected by the latest distribution tag.
  2. A user executes the command from the project documentation.
  3. npx downloads the mutable package and its dependency graph.
  4. Package code executes with the invoking user's permissions.
  5. The attacker can modify the skill installation, access user-visible data, or place malicious files in locations writable by that user.

Impact Assessment

Exploitation could result in arbitrary code execution with the installing user's privileges. If the command is run from an elevated shell, the impact would inherit those elevated privileges. Potential scope includes the user's OpenClaw workspace, robot-control code, local credentials readable by the process, and network-accessible systems.

Remediation
View remediation

Remediation Suggestions

  • Replace clawhub@latest with a specifically reviewed version.
  • Use a lock file and integrity metadata for the complete dependency graph.
  • Verify package provenance and signatures before execution.
  • Document the expected publisher, package checksum, and approved source.
  • Run installation under a dedicated, non-privileged account.
  • Review version updates before changing the documented version constraint.

T09 · Insecure Skill Coding Practices

Error
Location
jaka_skill.py:73
Finding

Unvalidated Parameters Are Passed Directly to Physical Robot Motion APIs

Content
View full analysis

Vulnerability Details

File Location: jaka_skill.py:73-108
Additional Locations: jaka_cmd.py:61-75, jaka_cmd.py:84-98, example_linear.py:21-45
Vulnerability Type: Missing safety validation for physical motion commands
Risk Level: High

Vulnerable Code

python
def move_joint(self, joints: List[float], speed: float = 0.5) -> bool:
    """关节运动（弧度制）"""
    if not self.connected:
        print("[错误] 未连接机器人")
        return False
    try:
        self.robot.set_rapidrate(speed)
        result = self.robot.joint_move(joints, 0, 1, speed)
        if result[0] == 0:
            print(f"[成功] 关节运动完成：{[round(j*180/math.pi,1) for j in joints]}°")
            return True
        print(f"[错误] 关节运动失败：{result}")
        return False
    except Exception as e:
        print(f"[错误] 关节运动异常：{e}")
        return False

def move_linear(self, pose: List[float], speed: float = 200) -> bool:
    """
    直线运动（mm/度制）

    Args:
        pose: [x, y, z, rx, ry, rz] 位置 (mm) + 姿态 (度)
        speed: 速度 mm/s (默认 200mm/s)
    """
    if not self.connected:
        print("[错误] 未连接机器人")
        return False
    try:
        pose_rad = (
            pose[0], pose[1], pose[2],
            pose[3] * math.pi / 180,
            pose[4] * math.pi / 180,
            pose[5] * math.pi / 180
        )

        acc = speed / 2
        tol = 0.1
        result = self.robot.linear_move_extend(pose_rad, 0, 0, speed, acc, tol)

The command-line layer only converts supplied values to floating-point numbers before invoking these methods:

python
joints_deg = [float(a) for a in args[:6]]
joints_rad = [j * math.pi / 180 for j in joints_deg]
...
robot.move_joint(joints_rad, speed=0.3)
python
pose = [float(a) for a in args[:6]]
...
robot.move_linear(pose, speed=100)

Technical Analysis

Motion inputs are forwarded to the robot SDK without enforcing: ...[truncated 1800 chars]

Remediation
View remediation

Remediation Suggestions

  • Require exactly six values for every joint or pose request.
  • Validate all values with math.isfinite() before calculations or SDK calls.
  • Enforce model-specific joint limits and Cartesian workspace boundaries.
  • Define strict minimum and maximum speed and acceleration values for each supported robot model.
  • Reject negative, zero, non-finite, and excessive motion parameters.
  • Add configurable prohibited zones and collision-aware path validation.
  • Verify emergency-stop, protective-stop, operating-mode, enable, payload, and safety-controller status before every movement.
  • Default to reduced-speed operation and require explicit operator confirmation for higher speeds.
  • Separate read-only status access from motion authority.
  • Require authentication and authorization in any service that exposes these methods remotely.
  • Preserve the robot controller's certified safety functions rather than treating application validation as a replacement.
  • Add tests covering boundary values, malformed vectors, NaN, infinity, negative speeds, and unreachable poses.

T09 · Insecure Skill Coding Practices

Error
Location
jaka_skill.py:113
Finding

Linear Motion Timeout Is Incorrectly Reported as Successful Completion

Content
View full analysis

Vulnerability Details

File Location: jaka_skill.py:113-122
Vulnerability Type: Fail-open motion completion handling
Risk Level: High

Vulnerable Code

python
# 轮询等待完成
for i in range(100):
    time.sleep(0.2)
    if self.robot.is_in_pos()[1]:
        break

print(f"[成功] 直线运动完成：{pose[:3]}mm, 速度{speed}mm/s")
return True

Technical Analysis

The method polls the robot for approximately 20 seconds. If is_in_pos() never reports completion, the loop terminates normally and execution still prints a success message and returns True.

The code also accesses element [1] without first validating the SDK status code, response length, or response type. As a result, it does not distinguish among confirmed completion, timeout, communication errors, controller faults, or malformed SDK responses.

This is a fail-open state-management flaw. Callers can interpret True as proof that the robot has reached the requested pose even when the robot remains in motion, is stalled, or has faulted.

Attack Path

  1. A target pose is unreachable, movement is obstructed, communication is degraded, or an attacker deliberately supplies a motion that cannot complete within the polling period.
  2. is_in_pos() fails to confirm arrival during all 100 polling iterations.
  3. The loop expires without entering the break branch.
  4. The method reports success and returns True.
  5. Downstream automation starts another movement, actuates an end effector, releases a payload, or enters the robot workspace based on a false completion state.

Impact Assessment

No additional operating-system privilege is obtained. The impact arises from misleading safety-critical automation that already has authority over the connected robot. Unsafe command sequencing can cause concurrent or premature actions, collisions, damaged workpieces, dropped payloads, operational interruption, or injury to nearby personnel.

Remediation
View remediation

Remediation Suggestions

  • Track whether an in-position response was actually received and return failure when the timeout expires.
  • Validate the SDK return code, response type, and response length before accessing the completion value.
  • Distinguish timeout, communication failure, controller fault, protective stop, and rejected motion in the returned result.
  • On timeout, invoke the vendor-supported safe stop or controlled deceleration mechanism where appropriate.
  • Do not issue subsequent actions until completion has been positively confirmed.
  • Use a monotonic deadline instead of relying solely on a fixed iteration count.
  • Record the target, elapsed time, controller state, and error code for diagnostics.
  • Add automated tests in which is_in_pos() remains false, returns an error code, or returns a malformed response.

A safe implementation should use an explicit completion flag, for example:

python
reached_target = False
deadline = time.monotonic() + 20.0

while time.monotonic() < deadline:
    time.sleep(0.2)
    status = self.robot.is_in_pos()
    if not isinstance(status, (tuple, list)) or len(status) < 2:
        return False
    if status[0] != 0:
        return False
    if status[1]:
        reached_target = True
        break

if not reached_target:
    return False

return True

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The home command triggers physical robot motion immediately after invocation, with no safety warning, no operator confirmation, and no checks for a safe workspace state. In a robot-control CLI, this can cause unintended movement around nearby people, tooling, or fixtures, making accidental misuse or unsafe automation materially dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The joint-motion command accepts arbitrary joint targets from the command line and immediately commands robot movement without confirmation, bounds validation, or user-facing hazard disclosure. Because this is direct actuation of a collaborative robot, a typo, malicious wrapper script, or operator misunderstanding could produce unsafe motion and potential collision or injury.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The linear-motion command performs Cartesian motion from raw user input with no confirmation or safety disclosure and no apparent validation of reachable or safe positions. Cartesian moves can create especially hazardous trajectories through the workspace, so issuing them directly from a CLI increases the chance of collision, equipment damage, or operator harm.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to run npx clawhub@latest install jaka-robotics-control, which pulls and executes the latest published package version rather than a pinned, reviewed release. This creates a supply-chain risk: if the package or one of its dependencies is compromised, users may execute untrusted code during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation shows how to connect to a robot, enable it, and issue joint and linear motion commands, but does not prominently require operator safety checks such as verifying the workspace is clear, ensuring an emergency stop is available, or confirming safe speed/limits before motion. In a robotics-control skill, omission of these safeguards materially increases the chance of unsafe physical movement, equipment damage, or human injury.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file presents core usage instructions in Chinese, which effectively forces a specific language for users without any opt-in or alternative. The policy for natural-language violations applies to all file types and specifically covers language or locale constraints that are not optional or justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The docstring and user-facing print messages are written in Chinese, and the file provides no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking context. This matches the policy concern for language or locale constraints imposed without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The user-facing documentation and runtime messages are presented in Chinese, which imposes a specific language without any opt-in or alternative. Under the stated policy, language constraints should be optional or clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The I/O command changes robot outputs immediately based on command-line input, without warning about downstream effects such as actuating grippers, tooling, conveyors, or external relays. In industrial environments, output toggles can trigger physical actions indirectly, so the lack of disclosure and confirmation creates a real safety and operational risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README is entirely written in Chinese and does not indicate that other languages are supported or that Chinese is a deliberate region-specific requirement. Under the stated policy, forcing a specific language without user opt-in or justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.