Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

TM Robot Control

v1.0.0

Control and monitor OMRON TM collaborative robots with motion commands, status feedback, safety controls, camera support, and IO handling.

0· 69·0 current·0 all-time
byRobot_Qu@qujingyang28
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name, README, SKILL.md, manifest and the code files (tm_robot.py, tm_camera.py, parser, scripts, examples, tests) align: this is a Python library to connect to TMflow/SCT/SVR and control OMRON TM robots using techmanpy and a custom SVR parser. The declared dependency (techmanpy) and required Python version match the implementation.
!
Instruction Scope
SKILL.md runtime instructions are narrowly scoped to connecting to the robot and using the library. However many included scripts reference and operate on local developer paths (e.g., C:/Users/JMO/.openclaw/workspace/skills/tm-robot/tm_robot.py) and some test scripts will actively move the robot/operate IO if executed. The file-modification utilities (fix_all.py, fix_indent.py, fix_parser.py) rewrite tm_robot.py in-place at hard-coded paths — these are outside normal runtime usage and could unexpectedly alter files if run.
Install Mechanism
No install specification is provided (instruction-only skill). All code is bundled in the skill; there are no external downloads or install scripts that fetch arbitrary remote archives. This is lower risk compared to remote installers.
Credentials
The skill declares no environment variables or credentials. Code includes a default ROBOT_IP in config.py and many scripts connect to 192.168.1.13 — reasonable for local robot control. No unrelated cloud credentials or secrets are requested.
Persistence & Privilege
Skill metadata does not request always:true or other elevated persistent privileges. It is user-invocable and allows autonomous invocation by default (normal). The code does not appear to modify other skills or system-wide agent settings.
What to consider before installing
This package largely matches its stated purpose (OMRON TM robot control) and contains real control, parser and camera code — but exercise caution before running anything: - Do NOT run the included fix_*.py scripts without reviewing them. They contain hard-coded Windows paths (C:/Users/JMO/...) and will overwrite tm_robot.py at that path if executed. These look like developer cleanup tools left in the tree and are not required to use the skill. - The test and example scripts will open sockets to 192.168.1.13:5890/5891 and may send motion commands (including stop/reset/zero). Running them on a network with a real robot can move hardware; always ensure the robot is isolated and in a safe environment before executing motion scripts. - Change the default ROBOT_IP in config.py before use, and inspect all scripts for hard-coded IPs or paths. Search the codebase for absolute paths and any write operations (open(..., 'w')). - If you will install into a shared workspace, consider cloning to an isolated environment and running static analysis (or grep) for file writes, external network destinations, or subprocess/exec usage. - Verify the upstream repository/homepage links and the author (RobotQu). If you need higher assurance, ask the author for a signed release, git history, or a canonical GitHub release to confirm provenance. Given these developer-tool leftovers that can modify files and the physical safety implications of robot-control scripts, I rate the package as suspicious — not clearly malicious, but containing unexpected artifacts you should audit and remove/disable before running.

Like a lobster shell, security has layers — review code before you run it.

armvk97ftmwnvbmpqqtdbpv1yhs54h840ydpcontrolvk97ftmwnvbmpqqtdbpv1yhs54h840ydplatestvk97ftmwnvbmpqqtdbpv1yhs54h840ydpomronvk97ftmwnvbmpqqtdbpv1yhs54h840ydppythonvk97ftmwnvbmpqqtdbpv1yhs54h840ydprobotvk97ftmwnvbmpqqtdbpv1yhs54h840ydpsdkvk97ftmwnvbmpqqtdbpv1yhs54h840ydptmvk97ftmwnvbmpqqtdbpv1yhs54h840ydp

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments