T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:409- Finding
Unvalidated Inbox Snapshots Are Automatically Restored into Future Agent Sessions
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Swarm Network
Security checks for vulnerabilities and agentic risk
Overview
This skill is for agent coordination, but it automatically saves and restores sensitive session context in plaintext and relies on a persistent network-capable daemon.
Install only if you intentionally want persistent cross-session agent memory and peer networking. Before use, pin and verify the Pilot Protocol build, disable or closely control auto-restore and auto-snapshot behavior where possible, treat restored inbox content as untrusted, secure and regularly clear ~/.pilot, and avoid storing secrets in sessions that may be snapshotted.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
README.md:102- Finding
Context Snapshots Persist Sensitive Session Data as Unencrypted JSON
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:44- Finding
Installation Instructions Build a Security-Critical Dependency from an Unpinned Upstream Branch
- Content
View full analysis
- Remediation
View remediation
git verify-commit go mod verify go build -trimpath -o pilotctl ``` 5. Pin and review the Go module dependency graph and retain `go.sum` in the reviewed release. 6. Document the exact supported upstream version in `manifest.json`. 7. Use reproducible builds and publish attestations or a software bill of materials. 8. Verify the installed binary's hash before each use or place it in a protected, immutable installation location. 9. Establish an update process that requires explicit user approval and repeats signature, checksum, and source-review checks. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The skill intentionally enables cross-session persistence and auto-restore of context snapshots, and the README explicitly states those snapshots are stored as plain JSON in ~/.pilot/inbox/ and may contain PII, API keys, and session secrets. In this skill's context, persistence is core functionality, but storing sensitive agent state unencrypted at rest significantly raises the risk of credential theft, privacy exposure, and unintended propagation of prior-session secrets into new sessions.
- Content
md git clone https://github.com/TeoSlayer/pilotprotocol.git cd pilotprotocol go build -o pilotctl mkdir -p ~/.pilot/bin && mv pilotctl ~/.pilot/bin/pilotctl # 2) Install this Skill openclaw skills install github:sarahmirrand001-oss/openclaw-skill-pilot-protocol
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README presents the skill as operating 'entirely within the local ~/.pilot/ directory' while also documenting peer-to-peer messaging, file transfer, webhook monitoring, gateway IP bridging, rendezvous on TCP :9000, and multi-node communication. This inconsistency can mislead operators about trust boundaries and network exposure, increasing the chance they deploy a network-capable daemon without appropriate firewalling, peer trust review, or data handling controls.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The invocation guidance is very broad, covering cross-session persistence, multi-agent coordination, and context overflow handling, which can cause the skill to activate in many unrelated workflows. Because this skill performs command execution, file writes, persistence, and network actions, overbroad triggering raises the chance of unnecessary privileged behavior and accidental data movement.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | **Script Exec** | `~/.pilot/pilot-publish.sh` | Event publishing helper script | | **Process** | Daemon lifecycle | Start/stop/status of the pilotctl daemon | > **Privacy Note:** All inter-agent traffic is encrypted end-to-end using X25519 key exchange + AES-256-GCM. Agents are private by default and require mutual trust handshake before communication. No data passes through relay servers. The rendezvous registry defaults to localhost (`127.0.0.1:9000`) — no peer-discovery metadata leaves the machine unless you explicitly change `registry_url` to a remote address. Snapshots are unencrypted JSON; you must secure the `~/.pilot/` directory (`chmod 700`). ---
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | **Script Exec** | `~/.pilot/pilot-publish.sh` | Event publishing helper script | | **Process** | Daemon lifecycle | Start/stop/status of the pilotctl daemon | > **Privacy Note:** All inter-agent traffic is encrypted end-to-end using X25519 key exchange + AES-256-GCM. Agents are private by default and require mutual trust handshake before communication. No data passes through relay servers. The rendezvous registry defaults to localhost (`127.0.0.1:9000`) — no peer-discovery metadata leaves the machine unless you explicitly change `registry_url` to a remote address. Snapshots are unencrypted JSON; you must secure the `~/.pilot/` directory (`chmod 700`). ---
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | **Script Exec** | `~/.pilot/pilot-publish.sh` | Event publishing helper script | | **Process** | Daemon lifecycle | Start/stop/status of the pilotctl daemon | > **Privacy Note:** All inter-agent traffic is encrypted end-to-end using X25519 key exchange + AES-256-GCM. Agents are private by default and require mutual trust handshake before communication. No data passes through relay servers. The rendezvous registry defaults to localhost (`127.0.0.1:9000`) — no peer-discovery metadata leaves the machine unless you explicitly change `registry_url` to a remote address. Snapshots are unencrypted JSON; you must secure the `~/.pilot/` directory (`chmod 700`). ---
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
json | **Script Exec** | `~/.pilot/pilot-publish.sh` | Event publishing helper script | | **Process** | Daemon lifecycle | Start/stop/status of the pilotctl daemon | > **Privacy Note:** All inter-agent traffic is encrypted end-to-end using X25519 key exchange + AES-256-GCM. Agents are private by default and require mutual trust handshake before communication. No data passes through relay servers. The rendezvous registry defaults to localhost (`127.0.0.1:9000`) — no peer-discovery metadata leaves the machine unless you explicitly change `registry_url` to a remote address. Snapshots are unencrypted JSON; you must secure the `~/.pilot/` directory (`chmod 700`). ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Directly writing messages or snapshots into
~/.pilot/inbox/bypasses stronger protocol-level controls and normalizes filesystem-based persistence as a fallback path. If other local processes or compromised components can write there, forged or malicious inbox content could later be consumed as trusted agent state.- Content
md | Operation | Multi-node Command | Single-node Alternative | |-----------|-------------------|------------------------| | Publish event | `pilotctl publish keke-agent topic --data ...` | `~/.pilot/pilot-publish.sh topic '{"key":"val"}'` | | Send to inbox | `pilotctl send-message keke-agent --data ...` | Write file directly to `~/.pilot/inbox/` | | Context snapshot | `pilotctl send-message ...` | `~/.pilot/context-snapshot.sh` | | Read inbox | `pilotctl inbox` → read `~/.pilot/inbox/` | Same (read directory directly) | | Check status | `pilotctl info` | ✅ Works normally |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 96% confidence
- Finding
The manual snapshot example writes structured context data directly into a predictable file in
~/.pilot/inbox/, creating durable plaintext session artifacts. This is dangerous because it persists potentially sensitive context at rest and creates an injection point where later sessions may ingest attacker-planted or tampered snapshot files.- Content
Using the snapshot script (works in both single-node and multi-node)
~/.pilot/context-snapshot.sh SESSION_ID "Key summary of current context"
Or manually write to inbox
echo '{"type":"context_snapshot","session_id":"ID","summary":"Summary"}' > ~/.pilot/inbox/snapshot_$(date +%Y%m%d_%H%M%S).json
text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs new sessions to read prior snapshots from the inbox and restore context, establishing cross-session persistence of potentially sensitive information. Because snapshots are described as unencrypted JSON and restoration is part of the default workflow, secrets, personal data, or stale instructions can be retained and reintroduced without strong user awareness or validation.
- Content
1.2 Restore Context
When a new session starts, read the previous session's snapshot:
bash ~/.pilot/bin/pilotctl --json inbox
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 81% confidence
- Finding
Spawning sub-agents for overflow tasks expands the number of principals that can receive or process context, increasing persistence and propagation of user data beyond a single session or actor. In this skill, overflow handling is tied to coordination and result collection, so context may be copied into additional channels without a clear user-controlled boundary.
- Content
3.2 Spawning Sub-Agents
When OpenClaw needs to create a sub-agent for overflow tasks:
bash # Publish agent spawn event
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The tag conventions embed a language-specific routing preference, recommending Chinese tasks be routed to certain models without indicating user choice or consent. While not directly a code execution flaw, it can steer user data to different agents or models than expected, affecting privacy, policy compliance, or trust boundaries.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill manifest and top-level description frame the capability as agent messaging and context coordination, but the body also adds gateway IP bridging and webhook delivery that can expose local services over HTTP and stream daemon events to an endpoint. These are materially different, network-expanding behaviors that increase attack surface and can lead to unintended service exposure or data exfiltration if invoked without explicit user awareness.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Gateway IP bridging is broader than the stated need for agent coordination because it can publish local model or agent services onto a reachable interface and encourage access through standard HTTP tools. That turns a coordination skill into a service-exposure mechanism, which is dangerous if users invoke the skill for benign context persistence and do not expect network reachability changes.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
The standing orders instruct the skill to automatically execute snapshots before session end and to auto-restore on new sessions, which creates autonomous persistence behavior without per-event user confirmation. In a skill that handles sensitive context and writes unencrypted JSON snapshots, this can preserve and re-inject data the user did not intend to retain or reuse.
- Content
md ## Standing Orders (Automation Rules) ### Rule 1: Snapshot Before Session End Automatically execute a context snapshot (Capability 1.1) before every session ends. ### Rule 2: Critical Events Must Be Published The following events must always be published to the Event Stream:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
json "~/.pilot/pilot-publish.sh — event publishing helper" ], "system_privileges": [ "NO root/sudo required. Gateway bridging over user ports (>1024) is strictly unprivileged." ] }, "network_behavior": {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is configured to auto-run on broad lifecycle events such as session start, session end, model switch, and context overflow. In a skill designed for cross-session persistence and inter-agent communication, this increases the chance of unreviewed activation, unintended data propagation, and persistence of sensitive context without an explicit user decision each time.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Automatic context snapshots on session end and overflow can capture arbitrary in-session content, including secrets, PII, tokens, or confidential prompts, and store them for later reuse. Because this skill explicitly supports cross-session persistence and agent coordination, the saved data may later be restored, read by other components, or transferred indirectly, magnifying confidentiality risk.
- Content
Static analysis
No suspicious patterns detected.