robot-motion
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
subprocess.Popenwithinserver/motion_server/providers/moveit_py.pyto launch a joint state seeder. This execution is restricted to internal modules using the current system Python interpreter. - [REMOTE_CODE_EXECUTION]: The artifact generator in
scripts/gen_motion_artifacts/cli.pyusesimportlibto dynamically load and execute agen_motionfunction from local Python files. This is the primary intended mechanism for reading motion specifications from user-defined scripts within the repository. - [EXTERNAL_DOWNLOADS]: The
scripts/setup.shandenvironment.ymlfiles facilitate the installation of ROS 2 and MoveIt 2 dependencies from trusted repositories such as Conda-Forge and RoboStack. - [SAFE]: The skill implements robust path-validation logic in
server/motion_server/context.pyusingpathlib.Path.relative_toto ensure that all file access for URDFs and configuration sidecars remains strictly within the repository boundaries, effectively preventing directory traversal attacks.
Audit Metadata