Robotics Security Hardening

A hands-on guide for hardening ROS2 robots end to end: SROS2/DDS encryption, network segmentation, secrets, container security, and cyber-physical safety.

Security & ReviewAdvanced★ 354⑂ 45AI score 8/10Last updated: Aug 12, 2026

What it does

SROS2/DDS security setup: keystore creation, per-node enclaves, governance and permissions XML, and Enforce strategy wiring, with real commands and XML samples.
Network hardening: control/data/management VLAN split, iptables rules for DDS ports 7400–7700, and disabling multicast discovery in CycloneDDS/FastDDS via unicast peer lists.
Host and container hardening: key-only SSH, fail2ban, unattended security updates, package minimization, non-root containers, read-only rootfs, trivy scanning and cosign signing.
Secrets and certificate lifecycle: systemd EnvironmentFile injection, keystore file permissions, monthly cert rotation script, plus a warning that expired permissions cause silent discovery-time outages.
Cyber-physical safety: hardwired e-stop independence, safety-controller (MCU) isolation, a velocity/acceleration safety gate node, and hardware watchdog usage.
8 anti-patterns plus audit tooling: unauthenticated /cmd_vel, shared fleet SSH keys, running nodes as root, and more — each with a fix, plus auditd rules and a /cmd_vel anomaly detector.

Who it's for

Robotics engineers deploying ROS2 robots into production or industrial environments
Security/DevOps engineers auditing a robot fleet
Teams mapping IEC 62443-style industrial security requirements onto robots

Example uses

"Enable SROS2 on our AMR" — get keystore commands, per-node enclaves, least-privilege permissions XML, and the launch-file environment variables in one pass.
"Harden the robot's onboard computer" — receive sshd_config, fail2ban, unattended-upgrades, package purge, and auditd rule recommendations.
"How do I stop cmd_vel spoofing?" — get a three-layer design: DDS-level access control, a velocity/acceleration safety gate, and a z-score anomaly detector.

· · · Install guide · · ·

Try it now, no install

Paste this into Claude to use the skill without installing anything.

Read the instructions in this file and follow them to help me:
https://raw.githubusercontent.com/arpitg1304/robotics-agent-skills/HEAD/skills/robotics-security/SKILL.md

What I want: (describe your task here)

If Claude can't open the link, open it yourself and paste the contents instead.

↓ If it works for you, download the ZIP below and install it. Then it runs on its own — no pasting each time.

Install in the Claude app (no terminal)

Download the ZIP with the button below.
In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.

↓ Download ZIP

Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on Claude Skill Mart.
Copy the skills/robotics-security folder from the GitHub repo arpitg1304/robotics-agent-skills into my ~/.claude/skills/robotics-security/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone https://github.com/arpitg1304/robotics-agent-skills.git && mkdir -p ~/.claude/skills && cp -r robotics-agent-skills/skills/robotics-security ~/.claude/skills/

⚠ This is a third-party skill. Check the source repository before installing.

Open a terminal and go to your home directory: cd ~
Clone the repository: git clone https://github.com/arpitg1304/robotics-agent-skills.git
Create the skills directory if needed: mkdir -p ~/.claude/skills
Copy just this skill: cp -r robotics-agent-skills/skills/robotics-security ~/.claude/skills/
Verify the install: ls ~/.claude/skills/robotics-security/SKILL.md
Restart Claude Code, then ask something like "Set up SROS2 encryption and access control for my robot."
(Recommended) Test any iptables, netplan, or fstab snippets on a lab machine or staging robot before applying them to a live system.

View source on GitHub ↗License: Apache-2.0