Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Vector Control

v1.0.1

Control a Vector robot via Wirepod’s local HTTP API on the same network. Use when you need to move Vector, tilt head/lift, speak text, capture camera frames, or run patrol/explore routines from the Pi/Wirepod host. Includes a CLI helper script and endpoint reference.

2· 1.9k·3 current·3 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The skill's name/description align with the included script and API reference: it implements movement, speech, camera snapshot, patrol/explore, and audio playback via Wirepod HTTP endpoints. One minor mismatch: the script invokes ffmpeg to convert audio but the SKILL.md / registry metadata do not declare ffmpeg or any required binary dependency.
Instruction Scope
SKILL.md instructs the agent/user to run the bundled CLI script and to use local Wirepod endpoints (default base http://localhost:8080). The script itself reads only user-supplied audio files and writes temporary WAVs to /tmp, and uses the Wirepod API. It does allow overriding --base to any URL, which could direct requests (including audio uploads) to a remote host if misused — the documentation expects same-network/local usage but does not enforce it.
Install Mechanism
There is no install spec (instruction-only plus a script), so nothing will be automatically downloaded or written by an installer. This is low-risk. Note: runtime dependency on ffmpeg is present but not declared; ffmpeg must be available on PATH for audio playback to work.
Credentials
The skill does not request any environment variables, credentials, or configuration paths. The SKILL.md references a local file path where an ESN may be found (/etc/wire-pod/.../botSdkInfo.json), but the script does not automatically read arbitrary system credentials. File I/O is limited to user-specified audio files and temporary /tmp files.
Persistence & Privilege
The skill is not always-enabled and does not request persistent system privileges or attempt to modify other skills or system-wide agent settings. It runs as a user-invoked CLI and performs network calls only to the configured base URL.
Assessment
This skill appears to do what it says: control a Vector robot over the local Wirepod HTTP API. Before installing/using it: (1) Ensure ffmpeg is installed on the host (the script calls ffmpeg but the skill metadata doesn't declare it). (2) Run the script on a trusted local network — the --base argument can point the script to any URL, so avoid directing it to untrusted external hosts (this would let audio or control commands go off-network). (3) When using the play command, only provide audio files you trust; the script reads them and writes a temporary WAV in /tmp which it removes afterwards. (4) Optionally inspect the script yourself (it's included) to confirm behavior before use. If you need the skill to be restricted to localhost only, consider modifying the script to enforce base='http://localhost:8080' or validating --base at runtime.

Like a lobster shell, security has layers — review code before you run it.

latestvk975s10sddp22zfhgyvn6278k180fdw3
1.9kdownloads
2stars
2versions
Updated 1h ago
v1.0.1
MIT-0

Vector Control

Overview

Control Vector through Wirepod’s /api-sdk/* endpoints and the camera stream at /cam-stream. Use this skill for movement, speech, camera snapshots, patrols, and exploration from the Pi.

Quick start (CLI)

Use the bundled script:

python3 skills/vector-control/scripts/vector_control.py --serial <ESN> assume
python3 skills/vector-control/scripts/vector_control.py --serial <ESN> say --text "Hello Dom"
python3 skills/vector-control/scripts/vector_control.py --serial <ESN> move --lw 160 --rw 160 --time 1.5
python3 skills/vector-control/scripts/vector_control.py --serial <ESN> snapshot --out /tmp/vector.mjpg

Find ESN/serial

If you don’t have it, read:

  • /etc/wire-pod/wire-pod/jdocs/botSdkInfo.json

Tasks

1) Assume / Release control

Always assume before movement, and release if the bot tips or a human needs manual control.

python3 .../vector_control.py --serial <ESN> assume
python3 .../vector_control.py --serial <ESN> release

2) Movement

  • move sends wheel speeds (0–200 typical). Use short timed moves.
python3 .../vector_control.py --serial <ESN> move --lw 120 --rw 120 --time 1.0

3) Head / Lift

python3 .../vector_control.py --serial <ESN> head --speed -2 --time 1.0
python3 .../vector_control.py --serial <ESN> lift --speed 2 --time 1.0

4) Speech

Speech can be interrupted by motion/camera. If it fails, pause after speaking before moving.

python3 .../vector_control.py --serial <ESN> say --text "Sneaking forward"
# wait 1–2s, then move

5) Camera snapshot

/cam-stream returns MJPG. Save it and convert to JPEG if needed (ffmpeg).

python3 .../vector_control.py --serial <ESN> snapshot --out /tmp/vector.mjpg
ffmpeg -y -loglevel error -i /tmp/vector.mjpg -frames:v 1 /tmp/vector.jpg

6) Play Audio (MP3/WAV)

Streams an audio file through Vector's speaker. Automatically converts to the required format (8kHz mono WAV).

python3 .../vector_control.py --serial <ESN> play --file /path/to/music.mp3

7) Patrol (deterministic sweep)

python3 .../vector_control.py --serial <ESN> patrol --steps 6 --speed 140 --step-time 1.2 --turn-time 0.8 --speak --phrase "Patrolling"

8) Explore (randomized wander)

python3 .../vector_control.py --serial <ESN> explore --steps 8 --speak --phrase "Exploring"

References

  • references/wirepod-api.md — endpoint list and notes.

Resources

scripts/

  • vector_control.py — CLI for basic control + patrol/explore routines.

references/

  • wirepod-api.md — HTTP API endpoints and usage notes.

Comments

Loading comments...