robotics-security

Name: robotics-security
Author: arpitg1304

320stars44forks

How to install robotics-security?

arpitg1304/robotics-agent-skills/robotics-security

$npx -y skills add arpitg1304/robotics-agent-skills --skill robotics-security

Installs into the current project.

Summary

Security hardening and best practices for robotic systems, covering SROS2 DDS security, network segmentation, secrets management, secure boot, and the physical-cyber safety intersection. Use this skill when securing ROS2 communications, configuring DDS encryption and access contr

Files · 1

View on GitHub

SKILL.md

1	# Robotics Security Skill
2
3	## When to Use This Skill
4	- Enabling SROS2 encryption and access control on ROS2 topics/services
5	- Generating keystores, certificates, and security policies for DDS
6	- Hardening robot onboard computers (SSH, firewalls, minimal packages)
7	- Setting up network segmentation between robot control/data/management planes
8	- Managing secrets and credentials across a robot fleet
9	- Securing Docker containers running ROS2 nodes
10	- Designing e-stop and safety systems that survive cyber compromise
11	- Auditing a robot system for security vulnerabilities
12	- Implementing secure boot and firmware verification
13	- Addressing IEC 62443 requirements for industrial robot deployments
14
15	## The Robot Attack Surface
16
17	Robots are unique: cyber vulnerabilities become physical threats.
18
19	```
20	NETWORK MIDDLEWARE APPLICATION
21	┌────────────────┐ ┌────────────────┐ ┌────────────────┐
22	│ Open DDS ports │───────▶│ Unauthenticated│──────────▶│ Hardcoded │
23	│ (7400-7500) │ │ /cmd_vel pub │ │ credentials │
24	│ Unsegmented LAN│ │ No msg signing │ │ Unvalidated cmd│
25	└────────────────┘ └────────────────┘ └────────────────┘
26	PHYSICAL FIRMWARE SUPPLY CHAIN
27	┌────────────────┐ ┌────────────────┐ ┌────────────────┐
28	│ USB/debug ports│───────▶│ Unsigned │──────────▶│ Compromised │
29	│ Serial consoles│ │ firmware OTA │ │ ROS packages │
30	│ Exposed SBCs │ │ No secure boot │ │ Unverified imgs│
31	└────────────────┘ └────────────────┘ └────────────────┘
32	```
33
34	\| Vector \| Impact \|
35	\|--------\|--------\|
36	\| Unauthenticated `/cmd_vel` \| Robot moves unexpectedly — injury/damage \|
37	\| Sensor spoofing (`/scan`, `/camera/image`) \| Robot collides, wrong decisions \|
38	\| Open DDS multicast discovery \| Full topic graph enumeration by passive listener \|
39	\| USB/serial physical access \| Root shell, firmware flash, data exfiltration \|
40	\| Unsigned firmware update \| Persistent backdoor in motor controllers \|
41
42	## SROS2: DDS Security
43
44	SROS2 wraps DDS Security to provide authentication, encryption, and access control at the DDS layer.
45
46	### Keystore Generation and Certificate Setup
47
48	```bash
49	export ROS_SECURITY_KEYSTORE=~/sros2_keystore
50	ros2 security create_keystore ${ROS_SECURITY_KEYSTORE}
51
52	# Generate per-node enclaves (use exact fully-qualified node names)
53	ros2 security create_enclave ${ROS_SECURITY_KEYSTORE} /my_robot/camera_driver
54	ros2 security create_enclave ${ROS_SECURITY_KEYSTORE} /my_robot/navigation
55	ros2 security create_enclave ${ROS_SECURITY_KEYSTORE} /my_robot/motor_controller
56	ros2 security create_enclave ${ROS_SECURITY_KEYSTORE} /my_robot/teleop
57
58	# Result:
59	# sros2_keystore/
60	# ├── enclaves/my_robot/{camera_driver,navigation,...}/
61	# │ ├── cert.pem, key.pem # Node identity
62	# │ ├── governance.p7s # Signed governance
63	# │ └── permissions.p7s # Signed permissions
64	# ├── public/ca.cert.pem # CA certificate
65	# └── private/ca.key.pem # CA private key — PROTECT THIS
66	```
67
68	### Security Policy XML
69
70	Governance — domain-wide security behavior:
71
72	```xml
73	<?xml version="1.0" encoding="UTF-8"?>
74	<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
75	xsi:noNamespaceSchemaLocation="omg_shared_ca_governance.xsd">
76	<domain_access_rules>
77	<domain_rule>
78	<domains><id_range><min>0</min><max>230</max></id_range></domains>
79	<allow_unauthenticated_participants>false</allow_unauthenticated_participants>
80	<enable_join_access_control>true</enable_join_access_control>
81	<discovery_protection_kind>ENCRYPT</discovery_protection_kind>
82	<liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
83	<rtps_protection_kind>ENCRYPT</rtps_protection_kind>
84	<topic_access_rules>
85	<topic_rule>
86	<topic_expression>*</topic_expression>
87	<enable_discovery_protection>true</enable_discovery_protection>
88	<enable_read_access_control>true</enable_read_acc

People who liked this also viewed

6 picks

Type

robotics-security

320stars44forks

View on GitHub

How to install robotics-security?

arpitg1304/robotics-agent-skills/robotics-security

$npx -y skills add arpitg1304/robotics-agent-skills --skill robotics-security

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Robotics Security Skill
2
3	## When to Use This Skill
4	- Enabling SROS2 encryption and access control on ROS2 topics/services
5	- Generating keystores, certificates, and security policies for DDS
6	- Hardening robot onboard computers (SSH, firewalls, minimal packages)
7	- Setting up network segmentation between robot control/data/management planes
8	- Managing secrets and credentials across a robot fleet
9	- Securing Docker containers running ROS2 nodes
10	- Designing e-stop and safety systems that survive cyber compromise
11	- Auditing a robot system for security vulnerabilities
12	- Implementing secure boot and firmware verification
13	- Addressing IEC 62443 requirements for industrial robot deployments
14
15	## The Robot Attack Surface
16
17	Robots are unique: cyber vulnerabilities become physical threats.
18
19	```
20	NETWORK MIDDLEWARE APPLICATION
21	┌────────────────┐ ┌────────────────┐ ┌────────────────┐
22	│ Open DDS ports │───────▶│ Unauthenticated│──────────▶│ Hardcoded │
23	│ (7400-7500) │ │ /cmd_vel pub │ │ credentials │
24	│ Unsegmented LAN│ │ No msg signing │ │ Unvalidated cmd│
25	└────────────────┘ └────────────────┘ └────────────────┘
26	PHYSICAL FIRMWARE SUPPLY CHAIN
27	┌────────────────┐ ┌────────────────┐ ┌────────────────┐
28	│ USB/debug ports│───────▶│ Unsigned │──────────▶│ Compromised │
29	│ Serial consoles│ │ firmware OTA │ │ ROS packages │
30	│ Exposed SBCs │ │ No secure boot │ │ Unverified imgs│
31	└────────────────┘ └────────────────┘ └────────────────┘
32	```
33
34	\| Vector \| Impact \|
35	\|--------\|--------\|
36	\| Unauthenticated `/cmd_vel` \| Robot moves unexpectedly — injury/damage \|
37	\| Sensor spoofing (`/scan`, `/camera/image`) \| Robot collides, wrong decisions \|
38	\| Open DDS multicast discovery \| Full topic graph enumeration by passive listener \|
39	\| USB/serial physical access \| Root shell, firmware flash, data exfiltration \|
40	\| Unsigned firmware update \| Persistent backdoor in motor controllers \|
41
42	## SROS2: DDS Security
43
44	SROS2 wraps DDS Security to provide authentication, encryption, and access control at the DDS layer.
45
46	### Keystore Generation and Certificate Setup
47
48	```bash
49	export ROS_SECURITY_KEYSTORE=~/sros2_keystore
50	ros2 security create_keystore ${ROS_SECURITY_KEYSTORE}
51
52	# Generate per-node enclaves (use exact fully-qualified node names)
53	ros2 security create_enclave ${ROS_SECURITY_KEYSTORE} /my_robot/camera_driver
54	ros2 security create_enclave ${ROS_SECURITY_KEYSTORE} /my_robot/navigation
55	ros2 security create_enclave ${ROS_SECURITY_KEYSTORE} /my_robot/motor_controller
56	ros2 security create_enclave ${ROS_SECURITY_KEYSTORE} /my_robot/teleop
57
58	# Result:
59	# sros2_keystore/
60	# ├── enclaves/my_robot/{camera_driver,navigation,...}/
61	# │ ├── cert.pem, key.pem # Node identity
62	# │ ├── governance.p7s # Signed governance
63	# │ └── permissions.p7s # Signed permissions
64	# ├── public/ca.cert.pem # CA certificate
65	# └── private/ca.key.pem # CA private key — PROTECT THIS
66	```
67
68	### Security Policy XML
69
70	Governance — domain-wide security behavior:
71
72	```xml
73	<?xml version="1.0" encoding="UTF-8"?>
74	<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
75	xsi:noNamespaceSchemaLocation="omg_shared_ca_governance.xsd">
76	<domain_access_rules>
77	<domain_rule>
78	<domains><id_range><min>0</min><max>230</max></id_range></domains>
79	<allow_unauthenticated_participants>false</allow_unauthenticated_participants>
80	<enable_join_access_control>true</enable_join_access_control>
81	<discovery_protection_kind>ENCRYPT</discovery_protection_kind>
82	<liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
83	<rtps_protection_kind>ENCRYPT</rtps_protection_kind>
84	<topic_access_rules>
85	<topic_rule>
86	<topic_expression>*</topic_expression>
87	<enable_discovery_protection>true</enable_discovery_protection>
88	<enable_read_access_control>true</enable_read_acc

People who liked this also viewed

6 picks

Type