Security audit

Universal Robots 机器人控制技能 - URSim 仿真 + URScript + RTDE

Security checks for vulnerabilities and agentic risk

Overview

The skill is genuinely about Universal Robots control, but several included scripts can move robots or actuate IO without strong safety gates or simulation-by-default controls.

Install only if you understand that this package can send live robot movement, IO, and force commands. Use it in URSim or an isolated supervised robot cell, bind Docker ports to localhost where possible, avoid disabling the firewall, pin dependencies and Docker images, and do not run motion tests on real hardware without independent safety checks and an emergency-stop-ready operator.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

Location: check_ur_rtde.py:7
Finding: Automatic Installation of an Unpinned Third-Party Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:121
Finding: Robot Simulator and Remote-Control Services Exposed on All Host Interfaces
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: run_all_tests.py:337
Finding: Test Suite Defaults to Active Robot Motion Without a Safety Interlock
Content: View full analysis
0.1: passed = False log_result(f"{joint_names[i]} 正方向", "FAIL", f"期望：{target[i]:.2f}, 实际：{actual[i]:.2f}") # 负方向 target = initial.copy() target[i] -= 0.524 rtde_s.sendJointPosition(target, speed=0.5) time.sleep(2) ``` ```python points = [ [0.3, 0.3, 0.5, 3.14, 0, 0], [0.4, 0.3, 0.5, 3.14, 0, 0], [0.4, 0.4, 0.5, 3.14, 0, 0], [0.3, 0.4, 0.5, 3.14, 0, 0], [0.3, 0.3, 0.5, 3.14, 0, 0], ] for point in points: rtde_s.sendPose(point, speed=0.3) time.sleep(2) ``` The suite also activates force mode: ```python rtde_s.sendForceMode( task_frame=[0, 0, 0, 0, 0, 0], selection_vector=[0, 0, 1, 0, 0, 0], wrench=[0, 0, -10, 0, 0, 0], bounds=[0.1, 0.1, 0.1, 0.1, 0.1, 0.1], gain=0.5 ) time.sleep(2) ``` ### Technical Analysis A no-argument invocation selects active m ...[truncated 1748 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: safety_check.py:32
Finding: Safety Checker Validates a Constant Pose Instead of Actual Robot State
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (83)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document provides concrete robot motion, circular motion, speed control, and force-control test commands without any explicit safety prerequisites such as verifying simulation mode, clearing the workspace, limiting speed/force, or ensuring an emergency stop is available. In a robotics context, these examples can be copied directly into a live system, creating a real risk of unintended motion, collision, pinching, or excessive contact force against people, fixtures, or equipment.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This script connects to a physical UR robot and begins issuing motion commands immediately, with no operator confirmation, enable/hold-to-run gate, workspace validation, or safety warning. In a robotics context, automatic motion can cause collisions, pinch/crush hazards, or damage to tooling and nearby equipment if the environment is not prepared or the coordinates are wrong.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script connects to a robot controller and immediately issues motion commands without any operator acknowledgement, mode check, workspace safety check, or emergency-stop validation. In a robotics context, unsolicited motion can cause equipment damage or physical injury if the script is run against a real robot or a simulator connected to physical hardware.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script sends robot motion commands immediately on execution and does not require operator confirmation, mode checks, workspace validation, or any explicit safety interlock before moving the robot. In a robotics context this can cause unexpected physical motion, creating collision and injury risk if the environment, tooling, or operator position is not verified first.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script defaults to real-hardware mode unless --simulate is provided and immediately runs motion, I/O, and force-control tests without any explicit safety confirmation, pre-run hazard warning, or operator interlock. In a robotics context this can cause unexpected physical movement or actuator changes on a connected UR robot, creating real safety risks to nearby people, tooling, and equipment.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script connects directly to a UR robot and issues multiple motion commands immediately, with no operator confirmation, interlock check, simulation-only guard, or emergency stop validation before movement. In a robotics context this is dangerous because execution can cause unexpected physical motion, creating collision and injury risk if run against real hardware or an incorrectly configured simulator target.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sends live robot motion commands immediately over a network socket and only informs the operator after the command has already been issued. For a physical robot, lack of an upfront warning, interlock, or explicit operator confirmation can lead to unexpected motion, creating collision and injury risk if the environment is not clear or the robot is not in a safe state.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script sends URScript motion commands directly to a UR robot/URSim secondary interface and immediately executes multiple joint and Cartesian moves without any operator acknowledgement, interlock check, mode verification, or emergency-stop/safeguard validation. In robotics contexts, even test motions can cause unexpected physical movement, collisions, or injury if the target is connected to real hardware or the workspace is not clear.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This script issues real robot joint moves, Cartesian moves, and digital output changes immediately after connecting, with no operator confirmation, interlocks, simulation-only guard, workspace validation, or emergency-stop checks. In a robotics context, unaudited motion and IO actions can cause collisions, equipment damage, or injury if the target is not actually an isolated simulator or if the environment has changed.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This script issues robot motion commands immediately after connecting, with no operator confirmation, mode check, workspace validation, or emergency-stop gating. Even though it is labeled as a URSim test, the code targets a fixed IP and would drive any reachable UR controller at that address, creating a real risk of unintended physical motion if pointed at hardware instead of a simulator.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code performs robot motion and toggles outputs immediately after connecting, with no interlock, environment validation, user confirmation, bounds checking, or emergency-stop awareness. In a real or misconfigured environment, this could cause unexpected physical movement or actuate attached tooling, creating safety and equipment risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This skill provides direct robot motion, force-control, speed-control, and IO examples that can actuate real hardware without any explicit safety warnings, interlocks, workspace validation, or emergency-stop guidance. In the context of industrial robot control, copy-pasteable examples that move joints, drive TCP positions, or toggle tool outputs can cause collision, crushing, dropped payloads, or tool activation if run on a connected robot in an unsafe environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The markdown describes real robot motion, IO, and force-mode testing steps but does not include explicit physical safety prerequisites such as emergency stop availability, workspace clearance, speed limits, supervision, or simulation-first validation. In a robot-control skill, omission of these warnings can contribute directly to unsafe operation, unintended motion, equipment damage, or human injury.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The document recommends pulling a Docker image by mutable tag/name only, without pinning to a specific version tag or immutable digest. This creates a supply-chain risk: future pulls may retrieve a different or compromised image than the one originally tested, which is especially concerning in a robotics context where simulation artifacts may influence operational decisions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manual migration steps instruct users to stop services, copy Docker data, move the original directory, and replace it with a symbolic link, but they do not clearly warn about data corruption, partial copy failure, or rollback prerequisites. This is dangerous because these operations affect local container state and are performed on critical application data with elevated privileges.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The document instructs users to pull a Docker image using an unpinned name without a specific tag or digest. This means the content fetched can change over time or be replaced upstream, leading to non-reproducible builds and possible execution of an unexpected or compromised image.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The docker run command ultimately executes an image reference that is not pinned to a specific version or digest. If the image behind that name changes, users may run different or malicious code than intended, especially since the container exposes multiple ports and mounts host storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The embedded PowerShell script forcefully kills Docker processes, copies data, moves the original directory, creates a symlink, and overwrites daemon.json without robust safety checks, backup validation, or rollback handling. In an agent skill context, users may execute it as-is with administrator privileges, risking service disruption, configuration loss, or failed migrations that leave Docker unusable.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This repeated docker pull command again uses an unpinned image reference, creating the same supply-chain risk and reproducibility problem. Because the file is instructional, readers are likely to copy-paste it directly, increasing the chance of pulling whatever image is current at execution time.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: This docker run example launches an unpinned image reference, so the executed container contents are not fixed or verifiable from the documentation alone. In context, the command also publishes network ports, which can magnify the effect of running a compromised or unexpected image.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The Docker image is referenced without a specific tag or digest, so users will pull whatever image is current at the time. This weakens reproducibility and supply-chain integrity because a compromised, changed, or incompatible image could be fetched without notice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The guide instructs users to disable the Windows firewall for testing without clearly warning about the resulting exposure. In this context, the document also opens network-reachable services and uses fixed ports, so disabling host protections can unnecessarily expose the machine and simulator services to other local or bridged networks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The guide recommends taskkill /PID <PID> /F without caution, which can terminate the wrong process if the PID is misidentified and may cause data loss or interrupt unrelated services. While this is more of an operational safety issue than a direct exploit vector, it can still cause avoidable harm on a user's system.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The guide instructs users to pull a Docker image by mutable name only, without a version tag or immutable digest. This creates a supply-chain risk because future pulls may retrieve a different or compromised image than the author intended, leading users to run unreviewed code locally with exposed ports.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The docker run instruction uses an unpinned image reference, so execution depends on whatever image currently resolves from the registry. In a setup guide, this is dangerous because users may immediately execute a changed image with network services exposed on host ports 8080 and 30001-30004.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.