Security audit

SenseRobot元萝卜AI下棋机器人

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended for a local chess robot, but it gives an agent high-impact robot-control, camera, microphone, and file-upload abilities without enough scoping, consent, or safety controls.

Review this skill carefully before installing. It is not clearly malicious, but it can move a physical robotic arm, clear a board, take photos, record audio, speak, and upload/display local images over unauthenticated local HTTP. Only use it on a trusted, isolated network with the robot physically supervised, and require explicit user confirmation before motion, board cleanup, photo, recording, or file-upload actions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.py:13
Finding: Unauthenticated Plaintext Control of Physical and Privacy-Sensitive Robot Functions
Content: View full analysis
Remediation: View remediation

other

Warning

Location: scripts/main.py:154
Finding: Public Placement Command Bypasses the Mandatory Pick-Before-Place Safety Invariant
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose is board/arm control, but the documented behavior also includes taking photos, recording audio, and displaying arbitrary images. That mismatch undermines user and policy expectations and can conceal surveillance or data-capture capabilities behind an innocuous robotics skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill provides recording and photo capabilities without clear privacy warnings, notice, or consent expectations. In a physical environment, undisclosed media capture can expose bystanders and sensitive information, making the omission materially risky.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Audio recording is broader than the stated function of manipulating Go pieces and controlling the board. In context, this creates an unnecessary surveillance capability that could capture nearby conversations or sensitive speech without clear justification or consent.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill exposes shell/network-capable instructions via curl but declares no explicit tool scope or permission boundary. In an agent environment, this can enable broader-than-expected outbound requests and device control without policy gating, increasing the risk of misuse or accidental invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Broad trigger phrases such as '下棋机器人' or '机械臂控制' without boundary rules can cause accidental skill activation. Because this skill can move a physical robotic arm and access sensors, unintended invocation raises both safety and privacy risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill performs physical robot-arm motion and board-clearing operations but does not warn users about mechanical safety, collision risk, or keeping hands/objects clear. In a robotics context, missing safety guidance increases the chance of accidental damage or injury from improper invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: 文档中的语音播报接口固定为 skill-tts-chinese，示例和速查表也均默认中文内容，未说明是否支持其他语言或由用户选择语言。若技能默认强制特定语言而无用户选择，属于语言/locale 策略风险。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documentation exposes camera, microphone, and image-display features that are omitted from the top-level description. Hidden or under-disclosed sensing capabilities are dangerous because users and orchestrators may authorize the skill for robot control without realizing it can capture media or render arbitrary content.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Arbitrary image upload/display is outside the stated robot-control purpose and broadens the skill beyond what users would expect. This can be abused to render misleading, offensive, or socially engineered content on the device without clear need for gameplay control.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The board-cleaning endpoint triggers a multi-minute physical action that removes pieces from the board, but the documentation does not clearly warn about irreversible state changes, interruption hazards, or the need for user confirmation. In a physical robotics context, an unexpected cleanup action can disrupt games, damage user trust, and create safety or collision concerns if initiated at the wrong time.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented API exposes photo capture, microphone recording, and arbitrary image display capabilities that go beyond the skill's stated chess-robot control purpose. In a robot with cameras, microphone, and display, these undocumented-in-manifest capabilities materially expand the attack surface to privacy invasion, covert sensing, and misleading on-device output if invoked by a user or downstream agent without clear authorization boundaries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The API reference describes camera and audio recording operations without any warning, consent flow, retention guidance, or privacy constraints. Because these endpoints can capture real-world images and microphone data, omission of privacy controls can enable covert surveillance or accidental collection of sensitive personal information in the robot's environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The cheat sheet includes robot actions such as arm reset, pick/place movement, and board cleaning without any safety cautions, precondition checks, or operator warnings. In a physical robotics context, undocumented destructive or motion-causing actions can lead to unintended movement, damage to the board or surroundings, and unsafe invocation by downstream agents.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The cheat sheet documents photo capture, audio recording, and arbitrary image display endpoints that go beyond the stated chess-robot control scope. Exposing surveillance and media/file-handling capabilities without clear scope limitation, consent requirements, or access controls increases the chance that an agent or operator will misuse them for unintended monitoring or content display.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation lists photo capture, audio recording, and file-upload/image-display endpoints without privacy warnings, consent requirements, or data-handling constraints. In practice, this can normalize collection of sensitive audio/images and ingestion of arbitrary files by an agent, creating privacy, compliance, and misuse risks beyond normal chess-robot operation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The module docstring and multiple command/help strings are written only in Chinese, and the API method tts explicitly targets /skill-tts-chinese. This indicates a language-specific skill behavior without any visible opt-in, language selection, or justification that the skill is intended only for a Chinese-language context.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill exposes camera capture, audio recording, and arbitrary image display capabilities that go beyond the stated robot-board-control purpose. Extra device capabilities widen the privacy and safety surface, especially for a robot in a physical environment, and could be abused by a caller to capture local surroundings or audio without clear user expectation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: show_image accepts an arbitrary local path and uploads that file to the robot service, enabling unintended exfiltration of local files readable by the process if an attacker can influence the argument. Although intended for image display, the lack of path restrictions, file-type validation, and purpose limitation makes this dangerous in an agent context.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/main.py (reported line 106)May include surrounding context.
python
try: # Use curl to upload the file cmd = ['curl', '--location', url, '--form', f'image=@"{image_path}"'] result = subprocess.run(cmd, capture_output=True, text=True, check=True) print(f"✅ 响应: {result.stdout[:500]}") return result.stdout except subprocess.CalledProcessError as e:

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The TTS section states that content is limited to Chinese content only, which is a language-policy constraint expressed in natural language. Because the document does not offer user opt-in/choice or explain a region-specific justification, this matches the locale/language policy concern under SQP-3.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The documented endpoint is specifically skill-tts-chinese, which indicates a fixed language choice in the skill behavior. Because the file does not mention that Chinese output is optional, configurable, or limited to a justified region-specific context, this appears to violate the language/locale choice policy.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.