isaac-sim-remote

Warn

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The client script scripts/isaacsim_send.py uses the eval() function in multiple locations (_inject_args, _wrap_isolated, and _parse_args_kv) to parse command-line arguments passed via the --arg flag into Python literals. While the execution environment for eval() is restricted by clearing __builtins__, this pattern involves dynamic processing of user-supplied strings from the shell environment.
  • [REMOTE_CODE_EXECUTION]: The core functionality of the skill is to facilitate the remote execution of arbitrary Python code on a running Isaac Sim instance. It accomplishes this by establishing a TCP connection to 127.0.0.1:8226 and transmitting raw or JSON-enveloped Python source code to be executed by the Isaac Sim server extension.
  • [COMMAND_EXECUTION]: The skill provides instructions and automation scripts that execute shell commands, including starting the Isaac Sim application (isaac-sim.sh) with various flags and using the nc (netcat) utility to poll network ports.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external, potentially attacker-controlled sources within the Isaac Sim environment, which could influence the agent's behavior if malicious instructions are embedded in those sources.
  • Ingestion points: The scripts/console_log.py script reads the Isaac Sim application log (/tmp/isaac_sim.log), and scripts/prim_properties.py and scripts/stage_info.py read metadata and attributes from the USD stage hierarchy.
  • Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore embedded commands within the logs or stage data being read.
  • Capability inventory: The skill possesses capabilities for network communication (TCP socket write), file system writing (saving screenshots and annotator data to /tmp), and arbitrary code execution on the local Isaac Sim service.
  • Sanitization: The skill does not perform sanitization, filtering, or escaping of the content retrieved from the logs or USD prim attributes before presenting it to the agent.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 10, 2026, 02:59 PM
Security Audit — agent-trust-hub — isaac-sim-remote