Solo Impl

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:35 AM UTC
• Version: 1.3.0

Overview

This is a disclosed Solo CLI robot executor, but it needs Review because it can install mutable remote code and run hardware-affecting shell commands with weak final user control.

Install only if you are comfortable with an agent running Solo CLI commands, opening terminals, controlling connected robot arms, changing local robot configuration, and installing mutable third-party code. Review each displayed command carefully, prefer pinned/package-manager installs where possible, keep the robot workspace clear, and avoid enabling Hub/W&B pushes unless you intend to use those credentials.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: domains/environment.json:3

Finding

Unverified Remote Installer Downloaded and Executed Directly

Content

View full analysis

"To install uv I need to run the official installer from astral.sh: > `curl -LsSf https://astral.sh/uv/install.sh | sh` > Reply **yes** to run it, or **no** to install uv yourself (e.g. `pip install uv` or `brew install uv` on macOS) and tell me when it's done." **Wait for the user's reply before running anything.** - If **yes**: run the installer via Shell tool, then validate with `uv --version`. - If **no**: wait for user to confirm uv is installed, then validate with `uv --version` and continue. ``` ### Technical Analysis The downloaded HTTP response is passed directly to `sh` on macOS and Linux. On Windows, the response returned by `Invoke-RestMethod` is passed directly to `Invoke-Expression`, while the PowerShell execution policy is explicitly bypassed. No version, content digest, signature, certificate identity beyond ordinary HTTPS validation, or immutable artifact reference is verified before execution. The effective code can therefore change after the Skill pac ...[truncated 1523 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: prompts/impl_executor_prompt.txt:209

Finding

Shell Command Injection Through Unescaped User-Controlled Parameters

Content

View full analysis

--repo-id --single-task "" --episode-time-s --num-episodes --leader-arms --follower-arms ` - Add `--push-to-hub 1` if push requested - Add `--cameras ` if cameras requested 3b. If `--push-to-hub 1` is included: apply Rule T3 (HuggingFace credential notice) before opening the terminal 4. Apply Rule T2: print the full command to the user, then open terminal window: - macOS: `osascript -e 'tell application "Terminal" to do script "cd && source .venv/bin/activate && "'` - Linux: `gnome-terminal -- bash -c "cd && source .venv/bin/activate && ; exec bash" &` ``` The corresponding domain definition includes free-form values: ```json "parameters": { "--robot-type": "SO100 | SO101 | Koch | bimanual | RealMan", "--repo-id": "local/ or HuggingFace repo ID (e.g. local/my_task or username/my_dataset)", "--single-task": "Human-readable description of the task (e.g. 'pick up the red block')", "--episode-time-s": "Duration per episode in seconds (e.g. 30)", "--num-episodes": "Number of episodes to record (e.g. 10)", "--leader-arms": "Leader arm ID from calibration config (e.g. leader_arm_1 or main_leader)", "--follower-arms": "Follower arm ID from calibration config (e.g. follower_arm_1 or main_follower)", "--cameras": "Optional: camera IDs and ang ...[truncated 2890 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: domains/environment.json:68

Finding

Unpinned and Mutable Third-Party Code Installed as Executable Software

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (34)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The activation text uses broad triggers such as 'do it for me', 'run', and 'execute', plus a catch-all for 'any Solo CLI action', which can cause the skill to engage on ambiguous user intent. In an executor skill that launches shell commands and terminal popups, overbroad routing increases the chance of unintended real-world actions and command execution without sufficiently specific user consent.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The skill endorses fetching and piping a remote installer script directly into a shell. Even with disclosure, curl | sh executes unaudited remote content at runtime, creating a strong supply-chain and remote-code-execution risk if the endpoint, transport, or script contents are compromised.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md

**Transparency rules (enforced in `prompts/impl_executor_prompt.txt`):**

- **curl | sh disclosure** — Before running the uv installer the agent shows the exact URL (`https://astral.sh/uv/install.sh`) and explains it is the official uv installer, then runs it. The user can abort at that point.
- **Terminal popup disclosure** — Before opening any terminal window (Mode 2B), the agent prints the full command that will run so the user can see it before it executes.
- **Credential transparency** — Before any push-to-hub or W&B operation, the agent explicitly tells the user which credential (`HUGGINGFACE_TOKEN` or `WANDB_API_KEY`) will be used and how it is sourced.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest explicitly enables autonomous physical actuation of a robot arm during inference ('follower arm acts autonomously') but provides no user-facing safety interlock, hazard warning, workspace clearance requirement, or confirmation step before motion begins. In an execution-oriented skill that actually runs terminal commands for the user, this omission materially increases the risk of unsafe robot movement, collision, pinching, or property damage from accidental or ill-timed invocation.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The prompt explicitly authorizes fetching and piping a remote shell script into sh, which is a classic high-risk pattern because it executes network-delivered code without local inspection or integrity verification. Even with disclosure and consent, this creates a strong supply-chain and remote code execution risk on the user's machine.

Content

Scanner excerpt · prompts/impl_executor_prompt.txt (reported line 24)May include surrounding context.

text

These rules exist so the user always knows what is about to happen before it happens.

### Rule T1 — curl | sh Explicit Consent

The uv installer fetches and pipes a remote shell script. Before running it, you MUST get explicit user consent — this is the one step that requires a reply before proceeding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The skill explicitly permits installation via 'curl | sh', which fetches a remote script and executes it immediately in the user's shell without local review, integrity verification, or pinning. In an executor skill, this is more dangerous because the agent is designed to actually run commands automatically, so compromise of the remote host, TLS interception, or unexpected script changes could directly lead to arbitrary code execution.

Content

Scanner excerpt · skill.json (reported line 43)May include surrounding context.

json

"external_installs": [
      {
        "url": "https://astral.sh/uv/install.sh",
        "method": "curl | sh",
        "purpose": "Official uv Python package manager installer from astral.sh. Disclosed to user before execution.",
        "alternatives": ["pip install uv", "brew install uv (macOS)"]
      }

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill requires immediate execution of interactive terminal commands after collecting parameters, explicitly forbidding a final confirmation step. That design removes an important safety checkpoint before opening a terminal and running commands that may move hardware, access devices, or use user-supplied paths and options.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

This instruction delegates execution decisions to the agent once it has inferred parameters from context, with no final human approval. In a shell-executing robotics skill, autonomous continuation from context to command execution raises the risk of acting on incorrect assumptions or stale session data.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

2. Infer any params already known from session context (don't re-ask)
3. Wait for the user's single reply
4. Construct the FULL command with all params as CLI flags
5. Open the terminal popup **immediately** — no confirmation step
6. The terminal MUST NOT re-prompt for anything

**All pre-flight params must be passed as CLI flags in the constructed command.** See `domains/data.json` and `domains/teleoperation.json` for the exact `--flag-name` for each parameter.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 82% confidence

Finding

The instruction 'Never tell the user to run a command' pushes the model toward direct execution in all cases, even where safer behavior would be to provide guidance or require explicit operator action. In context, this is behavior shaping that biases the system away from safer, lower-privilege alternatives and increases the chance of unintended command execution.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

## Rules

- **Never tell the user to run a command.** Not calibration. Not teleop. Not anything. You run everything.
- **Mode 2B commands open a real terminal popup** (osascript on macOS, gnome-terminal on Linux). Never run calibrate/setup_motors/record_dataset/teleop in the Shell tool subprocess — they hang because stdin is not connected.
- **One pre-flight message.** For parameterized Mode 2B commands, gather ALL unknown params in a SINGLE message. Check session context first — don't re-ask what you already know.
- **No confirmation step after pre-flight.** After the user answers, open the terminal popup immediately. Do not ask "ready to proceed?" or similar.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The rules explicitly prohibit a confirmation step and direct the agent to execute actions itself. This creates an autonomy pattern where potentially impactful shell and device operations can proceed without a deliberate user checkpoint immediately before execution.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

- **Never tell the user to run a command.** Not calibration. Not teleop. Not anything. You run everything.
- **Mode 2B commands open a real terminal popup** (osascript on macOS, gnome-terminal on Linux). Never run calibrate/setup_motors/record_dataset/teleop in the Shell tool subprocess — they hang because stdin is not connected.
- **One pre-flight message.** For parameterized Mode 2B commands, gather ALL unknown params in a SINGLE message. Check session context first — don't re-ask what you already know.
- **No confirmation step after pre-flight.** After the user answers, open the terminal popup immediately. Do not ask "ready to proceed?" or similar.
- **No hallucination.** Every command verbatim from the domain file's `command` field.
- **Port names are auto-detected.** Never ask the user for serial port paths.
- **`-y` flag on teleop.** Always use it to skip saved-settings prompts.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md

- **One pre-flight message.** For parameterized Mode 2B commands, gather ALL unknown params in a SINGLE message. Check session context first — don't re-ask what you already know.
- **No confirmation step after pre-flight.** After the user answers, open the terminal popup immediately. Do not ask "ready to proceed?" or similar.
- **No hallucination.** Every command verbatim from the domain file's `command` field.
- **Port names are auto-detected.** Never ask the user for serial port paths.
- **`-y` flag on teleop.** Always use it to skip saved-settings prompts.
- **Wait for physical confirmation.** Never self-report success for robot-interaction commands — wait for user to confirm arm moved correctly.
- **Hard boundary.** Not in domain files → _"That's outside what I can execute. Check https://docs.getsolo.tech or Discord: discord.gg/8kR5VvATUq"_

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill's security/privacy section materially understates what the executor may access. Elsewhere, the skill explicitly supports user-supplied dataset/model paths and conditionally uses credentials from environment variables or CLI login state, so claiming it reads only bundled files and terminal output is inaccurate and can mislead users about data exposure and trust boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This manifest entry exposes a hardware-affecting command that assigns motor IDs, but the description and trigger context are broad enough that an autonomous executor could invoke it without sufficiently explicit user confirmation. Because the command is interactive and changes device configuration, ambiguous scope increases the risk of unintended reconfiguration of connected hardware.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The calibration entry describes a command that changes hardware state and persists resulting configuration, yet the entry does not clearly constrain when autonomous execution is appropriate. In this skill context, the agent is designed to actually run terminal commands, so ambiguous invocation criteria can lead to accidental calibration runs on the wrong arm or at the wrong time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest notes that calibration saves configuration under ~/.solo/, but it does not present this as an explicit user-facing warning before execution. In an autonomous shell-executing skill, silently performing a persistent write can surprise users, alter future robot behavior, and make recovery harder if calibration was run incorrectly.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · domains/environment.json (reported line 28)May include surrounding context.

json

{
    "id": "create_venv",
    "domain": "environment",
    "description": "Create a Python 3.12 virtual environment using uv",
    "command": "uv venv --python 3.12",
    "inputs": [],
    "parameters": {},

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

This command can modify Linux group membership to grant serial-device access, and the presence of a '--yes / -y' parameter enables bypassing an interactive confirmation step. In an autonomous execution skill, that increases the risk of privilege-affecting system changes being applied without clear user acknowledgment, especially because group membership changes persist beyond the session.

Content

Scanner excerpt · domains/environment.json (reported line 105)May include surrounding context.

json

"command": "solo setup-usb",
    "inputs": [],
    "parameters": {
      "--yes / -y": "Skip confirmation prompt"
    },
    "explanation": "Adds the current user to the dialout group for serial access to Koch/SO100/SO101 arms. Only needed on Linux. Informational-only on macOS.",
    "expected_output": "USB permissions configured successfully",

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

The instruction to 'never ask the user for port paths' encourages the agent/tooling to make autonomous hardware-selection decisions during teleoperation. In a skill whose purpose is to actually execute robot-control commands, suppressing user verification around device selection can cause the wrong serial device or robot arm to be controlled, increasing the chance of unsafe physical behavior or unintended interaction with connected hardware.

Content

Scanner excerpt · domains/teleoperation.json (reported line 16)May include surrounding context.

json

"--yes / -y": "Auto-apply saved settings when available (skip saved-settings prompt)"
    },
    "command_construction": "solo robo --teleop --robot-type <type> --leader-arms <leader_id> --follower-arms <follower_id> [--cameras <cam_config>]",
    "port_detection": "Serial ports for leader and follower are auto-detected interactively by the tool — never ask the user for port paths.",
    "explanation": "You move the leader arm by hand; the follower copies motions in real time. Used for demos, data collection, and testing before autonomous policies run. Bimanual: move both leaders to control both followers.",
    "expected_output": "Teleop running — follower mirrors leader movement",
    "validation": {

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 88% confidence

Finding

The 'NEVER tell the user to run a command' rule pushes the agent toward maximal direct execution and suppresses safer alternatives such as giving commands for the user to review and run manually. In combination with Shell access, this behavior-manipulating framing increases the likelihood of risky automation and reduces meaningful user oversight.

Content

Scanner excerpt · prompts/impl_executor_prompt.txt (reported line 13)May include surrounding context.

text

## ABSOLUTE RULE — Read Before Everything Else

**NEVER tell the user to run a command. NEVER say "paste this in your terminal". You run all commands.**

The user physically interacts with the robot (moves arms, watches motion). That is all.
Everything else — every `solo`, `uv`, `git`, `curl`, `source`, `echo`, `ls`, `osascript` command — you execute yourself via Shell tool.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

This instruction explicitly requires opening a terminal and launching commands immediately after disclosure, with no confirmation pause. Because the skill executes real terminal commands on the user's machine, removing a final consent checkpoint increases the chance of accidental, unsafe, or attacker-prompted execution, especially for hardware-control operations.

Content

Scanner excerpt · prompts/impl_executor_prompt.txt (reported line 45)May include surrounding context.

text

> "Opening a terminal window with:
> `cd <CWD> && source .venv/bin/activate && <FULL_SOLO_COMMAND>`"

Then immediately run the `osascript` / `gnome-terminal` / `start cmd` command. No confirmation pause needed — just show the command first.

### Rule T3 — Credential Pre-Check

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest justifies running Solo CLI commands, including training and dataset operations, but these lines explicitly frame execution around using HUGGINGFACE_TOKEN, git credentials, huggingface-cli login, and WANDB_API_KEY. Handling external service authentication state is not necessary for a generic local command executor unless that capability is explicitly declared as part of the skill's scope.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The pre-flight protocol is designed to collect parameters once and then execute without any confirmation step. In an autonomous shell-executing skill, that pattern meaningfully reduces user control and makes it easier for ambiguous context, mistaken inference, or malicious prompt injection through user input to trigger unwanted actions on the host or robot.

Content

Scanner excerpt · prompts/impl_executor_prompt.txt (reported line 68)May include surrounding context.

text

1. **Collect ALL required parameters in a SINGLE message.** List every unknown param in one shot — never ask one at a time.
2. **Wait for the user's single response.** No follow-up questions.
3. **Construct the FULL command** with all params as CLI flags.
4. **Open the terminal popup immediately** with that full command — no confirmation step.
5. **Tell the user** what they will see in the terminal and what physical actions (if any) they need to perform.

The user's total interaction for any Mode 2B command: **one answer to your pre-flight question, then they watch the terminal popup appear.**

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Mode 1 commands are authorized to run immediately and automatically continue after validation, except for the curl | sh installer. Several of these commands can still alter the host environment or device state, so the absence of consent for all other state-changing actions creates an unnecessary autonomy risk.

Content

Scanner excerpt · prompts/impl_executor_prompt.txt (reported line 88)May include surrounding context.

text

Commands: `install_uv`, `create_venv`, `activate_venv`, `install_solo_cli`, `setup_usb_permissions`, `scan_motors`, `diagnose_arm`

Protocol:
1. If the command is `install_uv`: apply Rule T1 — ask for explicit yes/no consent before running. Wait for reply.
2. Run command via Shell tool
3. Run validation check
4. Report result, continue

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a standalone executor that runs Solo CLI actions itself and explicitly says it does not require solo_cli_guide to be installed. These lines add capability to load local tutorial graph files and to 'Activate solo_hub_guide', which is orchestration across tutorials/skills rather than direct Solo CLI execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The ad-hoc execution rule is broad enough that ordinary user phrasing could trigger real command execution with limited guardrails beyond parameter collection. In a skill designed to use a Shell tool, vague triggers materially increase the risk of unintended or socially engineered execution of destructive, privacy-impacting, or unsafe robot actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is an autonomous executor that runs terminal commands across setup, device control, data collection, training, and inference based on broad natural-language triggers like 'do it for me' or 'run'. Those triggers are not tightly scoped, so the skill could execute impactful actions with insufficient user confirmation or ambiguous intent, which is especially risky because it operates on the user's terminal and attached robot hardware.

Content

No source excerpt is available for this finding.