Roborock Vacuum Control via Telegram

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:53 AM UTC
• Version: 1.0.0

Overview

This is a plausible Roborock vacuum controller, but it needs review because its scripts execute shell config files and its chat commands can move a real device without clear confirmation safeguards.

Review before installing. Use this only on a trusted machine, protect jojo.env and Roborock credentials, avoid broad exec allowlisting, and add confirmation rules before allowing Telegram or shared-chat users to start, dock, stop, or room-clean the vacuum.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/jojo.sh:6

Finding

Arbitrary Shell Code Execution Through Sourced Configuration Files

Content

View full analysis

Vulnerability Details

File Location: scripts/jojo.sh:6-10 and scripts/refresh_room_aliases.sh:6-10
Vulnerability Type: Executable configuration file / arbitrary shell code execution
Risk Level: High

Vulnerable Code

scripts/jojo.sh:6-10:

bash

CONFIG_FILE="${JOJO_CONFIG_FILE:-$SKILL_DIR/jojo.env}"

if [[ -f "$CONFIG_FILE" ]]; then
  # shellcheck disable=SC1090
  source "$CONFIG_FILE"
fi

scripts/refresh_room_aliases.sh:6-10:

bash

CONFIG_FILE="${JOJO_CONFIG_FILE:-$SKILL_DIR/jojo.env}"

if [[ -f "$CONFIG_FILE" ]]; then
  # shellcheck disable=SC1090
  source "$CONFIG_FILE"
fi

Technical Analysis

Both executable entry points load the selected configuration file with Bash's source command. This does not treat the file as inert key-value data. Instead, Bash evaluates every statement in the file in the current process, including command substitutions, function definitions, redirections, external commands, and other shell syntax.

The JOJO_CONFIG_FILE environment variable can also redirect configuration loading to an arbitrary path accessible to the running user. Consequently, control over either the normal jojo.env file or the environment selecting another configuration file is equivalent to control over shell code executed by the skill.

For example, a malicious configuration could contain:

bash

JOJO_DEVICE_ID="$(malicious-command)"

The command would execute immediately when the file is sourced, before the requested Roborock operation is processed. Configuration can also set ROBOROCK_BIN, allowing a malicious executable to be selected for subsequent operations.

Attack Path

1. An attacker, compromised local process, or unsafe deployment mechanism obtains write access to jojo.env, or influences the JOJO_CONFIG_FILE environment variable.
2. The attacker inserts shell syntax or command substitution into the selected file.
3. A user or ...[truncated 1246 chars]

Remediation

View remediation

Remediation Suggestions

• Do not use source to read a data-only configuration file.
• Implement a strict parser that accepts only explicitly supported keys:
  • JOJO_DEVICE_ID
  • JOJO_DEVICE_NAME
  • ROOM_[A-Z0-9_]+
• Treat values as inert strings and reject command substitutions, shell operators, redirections, control characters, and unexpected multiline content.
• Validate room segment values as a narrowly defined numeric format, including comma-separated numeric lists only where explicitly supported.
• Remove the JOJO_CONFIG_FILE override if it is unnecessary. If it is required, constrain it to an approved directory and canonicalize the path before opening it.
• Require the configuration to be a regular, non-symlink file owned by the expected user and not writable by group or other users.
• Validate ROBOROCK_BIN separately or remove it from user-editable configuration. Prefer a trusted absolute executable path and verify file ownership and permissions.
• Apply restrictive permissions such as mode 0600 to configuration files that contain device identifiers or other sensitive values.

T08 · Insecure Dependencies

Warning

• Location: SETUP.md:19

Finding

Unpinned Third-Party Package Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SETUP.md:19-26
Vulnerability Type: Unpinned dependencies installed from a mutable package source
Risk Level: Medium

Vulnerable Code

bash

pipx install python-roborock

If runtime dependencies are missing, the documentation additionally directs users to run:

bash

pipx inject python-roborock PyYAML pyshark

Technical Analysis

The setup instructions install python-roborock, PyYAML, and pyshark without exact version constraints or integrity hashes. Package resolution therefore depends on whichever releases and transitive dependencies are available from the configured Python package index at installation time.

This makes the effective installed code mutable after the skill has been reviewed. A compromised package release, compromised package index, dependency confusion condition, malicious transitive dependency, or unexpectedly incompatible future release could introduce unreviewed code.

Python packages may execute package-controlled behavior during installation and will execute their installed code when imported or invoked later. The additional pipx inject instruction expands the dependency surface even when those injected packages may not be necessary for all installations.

Attack Path

1. A user follows the documented setup instructions.
2. pipx contacts its configured Python package index and resolves the latest available versions of the named packages and their transitive dependencies.
3. A compromised, substituted, or malicious package version is selected because no reviewed version or hash is enforced.
4. Package-controlled installation or runtime code executes under the user's operating-system account.
5. The compromised CLI may subsequently receive Roborock account context, device identifiers, and commands whenever the skill invokes it.

Impact Assessment

Exploitation could result in arbitrary code execution with ...[truncated 542 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed exact version.
• Maintain a lock file or constraints file that also fixes transitive dependency versions.
• Use integrity hashes for downloadable artifacts where supported.
• Document the expected trusted package index explicitly and avoid untrusted additional indexes.
• Review package provenance, maintainers, release history, and published artifacts before updating pinned versions.
• Remove PyYAML and pyshark injection from the default setup unless they are demonstrably required.
• If optional dependencies are necessary, pin and integrity-check them independently.
• Test dependency upgrades in an isolated environment before updating the documented versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description emphasizes a conversational control layer for routine vacuum actions through scripts/jojo.sh. The supplied code does not implement conversational control, Telegram interaction, or routine commands like clean/pause/status/go home. Instead, it performs a support/maintenance function: reading configuration, invoking the roborock CLI to list rooms, and transforming that data into ROOM_* alias assignments. While room alias refresh may support the larger skill, this chunk’s actual purpose is materially narrower and different from the declared primary purpose, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

panion layer, not just raw Roborock control. Execute the local shell wrapper in scripts/jojo.sh via exec; do not use ACP or sessions_spawn for routine control a

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

panion layer, not just raw Roborock control. Execute the local shell wrapper in scripts/jojo.sh via exec; do not use ACP or sessions_spawn for routine control a

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SETUP.md (reported line 43)May include surrounding context.

roborock list-devices

text

## 5. Create local config

Create `~/.openclaw/skills/jojo-bot/jojo.env` with:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to execute shell commands that cause real-world actions on a physical device, but it provides no warning, confirmation guidance, or safety gating for impactful commands like start, stop, room cleaning, or docking. In chat-driven contexts such as Telegram, this raises the risk of accidental, spoofed, or insufficiently reviewed commands causing unintended device movement or disruption in the user’s environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README advertises natural-language commands like 'clean the house', 'pause', and 'go home' for a real Roborock device but does not clearly warn that these prompts can cause immediate physical actions in the user's environment. In a chat/agent context, missing action-safety guidance increases the chance of accidental or unintended device operation, especially via Telegram or conversational use where users may treat examples as harmless text.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file instructs the user to authenticate to the Roborock CLI with their email, which implicates account access and transmission of user account data. The setup text gives no warning about handling authentication data or that login ties the skill to the user's Roborock account.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.