soarm-control

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:28 AM UTC
• Version: 1.0.1

Overview

This skill is a real robot-control package, but it exposes safety-critical motion, camera-based detection, and autonomous picking with weak disclosure and no visible authentication or safety gating.

Review carefully before installing or running. Use only with a supervised SOARM setup, keep the service bound to loopback or otherwise access-controlled, ensure a physical emergency stop and clear workspace are available, and treat /pick and movement endpoints as safety-critical actions that should require explicit operator approval.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/soarm_api.py:538

Finding

Unauthenticated HTTP Endpoints Permit Physical Robot Control

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/soarm_api.py:371

Finding

Safety-Critical Motion and Workload Parameters Lack Adequate Bounds Validation

Content

View full analysis

dict: if len(angles) != 6: raise ValueError("angles must contain 6 values.") if not 0.0 <= angles[5] <= 100.0: raise ValueError("gripper must be in [0, 100].") target = {f"{joint}.pos": float(value) for joint, value in zip(JOINTS, angles, strict=True)} ``` The API allows callers to control timing and inverse-kinematics parameters without upper bounds or finite-number validation: ```python @app.post("/move/joints") def move_joints(): payload = request.get_json(force=True, silent=False) or {} angles = payload.get("angles") sleep_s = float(payload.get("sleep", 2.0)) speed = float(payload.get("speed", DEFAULT_SPEED)) return jsonify(controller.move_joints(angles, sleep_s, speed)) @app.post("/move/xyz") def move_xyz(): payload = request.get_json(force=True, silent=False) or {} return jsonify( controller.move_xyz( x=float(payload["x"]), y=float(payload["y"]), z=float(payload["z"]), sleep_s=float(payload.get("sleep", 2.0)), speed=float(payload.get("speed", DEFAULT_SPEED)), max_iters=int(payload.get("max_iters", 300)), tol=float(payload.get("tol", 1e-3)), step_size=float(payload.get("step_size", 0.6)), damping=float(payload.get("damping", 1e-4)), ) ) ``` The standalone joint-control script has the same incomplete validation: ```python def main() -> int ...[truncated 3437 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description frames the skill as simple robot control, but the setup notes and endpoints indicate additional capabilities including pick-task automation and, per the finding, vision/detection behavior not disclosed in the description. Capability mismatch is dangerous because users and orchestrators may grant trust or invoke the skill without realizing it can sense the environment and perform autonomous physical actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs direct robot-arm motion without any warning about real-world hazards, collision risk, pinch points, or the need for operator confirmation. In a physical-control context, omission of safety interlocks and confirmation language can lead to property damage or bodily harm if an agent issues movement commands automatically or on ambiguous user input.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The examples provide ready-to-run movement and pick-operation commands that can immediately actuate hardware, yet they contain no caution about irreversible physical actions or operator supervision. Because these are copy-pastable commands, they materially lower the barrier to unsafe execution in an uncontrolled environment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill exposes operational capabilities that can interact with local services and environment-dependent components, but it declares no explicit tool scope or permission boundaries. In an agent setting, missing scope metadata can cause the skill to be invoked with broader authority than users expect, increasing the risk of unintended command execution against a robot-control service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

Read Current State

bash

curl -sS http://127.0.0.1:8000/joints

Returns current joint values and XYZ end-effector position.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Return to initial:

bash

curl -sS -X POST http://127.0.0.1:8000/move/joints \
  -H 'Content-Type: application/json' \
  -d '{"angles":[0,-104,95,65,-95,10]}'

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes a skill for controlling the robotic arm via joint-state reads and movement by joint angles or XYZ coordinates. This file additionally starts a YOLO-based vision pipeline and background detection thread, then exposes object-detection state and autonomous task orchestration, which is meaningfully broader than simple SOARM control operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Using OpenCV camera capture and YOLO inference is a distinct capability from reading joint states or moving the arm by angles/XYZ coordinates. Because the manifest does not mention vision, perception, or object recognition, this capability is unjustified by the stated purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The API returns several user-visible status messages in Chinese, such as success and in-progress responses, but the file does not offer any language selection or indicate that the skill is intentionally limited to a Chinese-speaking locale. This can violate language/locale policy when users have not opted into that language.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says to use this skill for reading joint state, moving by joint angles, moving by XYZ coordinates, or handling SOARM robot-control requests. The /pick endpoint initiates an autonomous multi-step grasp routine driven by detections and internal motion logic, which exceeds the narrower control-oriented description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The API exposes physical robot-motion and gripper actuation endpoints, including autonomous picking, without any authentication, authorization, confirmation, or safety gating visible in the code. If the service is reachable by another local process or network client, an attacker or accidental caller could trigger unintended motion, causing property damage or injury.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documented response message is shown only in Chinese, which can impose a specific language expectation without user opt-in. The file does not state that the skill is region-specific or provide an alternative language option.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest focuses on SOARM control operations, but the code also configures object-detection weights and camera source from environment variables, plus network bind settings later in the file. These capabilities support a broader vision/server role rather than the narrowly stated control purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The application initializes YOLO detection and opens a camera source as soon as the app is created, which is a privacy-relevant operation. There is no visible disclosure in this file warning that launching the service will access the camera and process live video.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.