ClawHub
Back to skill

Security audit

ROS Noetic Navigation

Security checks for vulnerabilities and agentic risk

Overview

This ROS navigation skill appears purpose-aligned, but it can move real robot hardware without a confirmation step or prominent safety warning.

Review this carefully before installing on a live robot. Use it only in a supervised, cleared area with emergency stop access, verify localization and waypoint coordinates first, and avoid exposing rosbridge beyond trusted local access.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The documentation provides robot navigation commands that can trigger real-world movement, but it does not include an explicit safety warning to verify the environment is clear, confirm supervision, or acknowledge collision and operational risks. In a robotics skill, omission of such warnings increases the chance of unsafe use, especially if an agent or user issues commands directly on a live platform.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script publishes navigation goals that can cause a robot to move in the physical world, but it does so immediately after parsing a command or waypoint name without any confirmation, authorization gate, or safety interlock. In a robotics context this is a real safety issue because accidental, spoofed, or misunderstood commands can directly trigger motion that may endanger people, property, or the robot itself.

Static analysis

No suspicious patterns detected.