Vector Control

Control a Vector robot via Wirepod’s local HTTP API on the same network. Use when you need to move Vector, tilt head/lift, speak text, capture camera frames, or run patrol/explore routines from the Pi/Wirepod host. Includes a CLI helper script and endpoint reference.

This skill appears to do what it says: control a Vector robot over the local Wirepod HTTP API. Before installing/using it: (1) Ensure ffmpeg is installed on the host (the script calls ffmpeg but the skill metadata doesn't declare it). (2) Run the script on a trusted local network — the --base argument can point the script to any URL, so avoid directing it to untrusted external hosts (this would let audio or control commands go off-network). (3) When using the play command, only provide audio files you trust; the script reads them and writes a temporary WAV in /tmp which it removes afterwards. (4) Optionally inspect the script yourself (it's included) to confirm behavior before use. If you need the skill to be restricted to localhost only, consider modifying the script to enforce base='http://localhost:8080' or validating --base at runtime.

Type: OpenClaw Skill Name: vector-control Version: 1.0.1 The skill is designed to control a local robot via a local API. While the `SKILL.md` instructions are benign and do not contain prompt injection attempts, the `scripts/vector_control.py` script includes risky capabilities. Specifically, it uses `subprocess.run` to execute `ffmpeg` with user-controlled input file paths (`args.file`), and allows writing camera snapshots to arbitrary local paths (`args.out`). Although these capabilities are plausibly needed for the stated purpose (audio conversion, saving snapshots), they represent broad file system access and command execution that could be leveraged by a malicious prompt to the AI agent, even if the skill itself does not explicitly instruct such harmful actions. All network communication is confined to `http://localhost:8080`, indicating no external data exfiltration.