isaac-sim-remote
Warn
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The client script
scripts/isaacsim_send.pyuses theeval()function in multiple locations (_inject_args,_wrap_isolated, and_parse_args_kv) to parse command-line arguments passed via the--argflag into Python literals. While the execution environment foreval()is restricted by clearing__builtins__, this pattern involves dynamic processing of user-supplied strings from the shell environment. - [REMOTE_CODE_EXECUTION]: The core functionality of the skill is to facilitate the remote execution of arbitrary Python code on a running Isaac Sim instance. It accomplishes this by establishing a TCP connection to
127.0.0.1:8226and transmitting raw or JSON-enveloped Python source code to be executed by the Isaac Sim server extension. - [COMMAND_EXECUTION]: The skill provides instructions and automation scripts that execute shell commands, including starting the Isaac Sim application (
isaac-sim.sh) with various flags and using thenc(netcat) utility to poll network ports. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external, potentially attacker-controlled sources within the Isaac Sim environment, which could influence the agent's behavior if malicious instructions are embedded in those sources.
- Ingestion points: The
scripts/console_log.pyscript reads the Isaac Sim application log (/tmp/isaac_sim.log), andscripts/prim_properties.pyandscripts/stage_info.pyread metadata and attributes from the USD stage hierarchy. - Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore embedded commands within the logs or stage data being read.
- Capability inventory: The skill possesses capabilities for network communication (TCP socket write), file system writing (saving screenshots and annotator data to
/tmp), and arbitrary code execution on the local Isaac Sim service. - Sanitization: The skill does not perform sanitization, filtering, or escaping of the content retrieved from the logs or USD prim attributes before presenting it to the agent.
Audit Metadata