Pilot Quality Assurance Pipeline Setup

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.0.0

Overview

This is a coherent QA pipeline setup guide, but users should be careful about what test data is shared with external reporting tools.

Install only if you trust the Pilot ecosystem dependencies and have approved the reporting destinations. Before enabling the reporter role, review what QA data may be sent to Slack, webhooks, dashboards, or bug trackers, and redact secrets, internal URLs, screenshots, PII, or proprietary failure details where appropriate.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README states that the reporter files bugs and notifies teams, but it does not clearly warn that test results, logs, screenshots, and related QA metadata may leave the local agent boundary and be sent to third-party systems. In a QA pipeline, those artifacts often contain sensitive code context, internal URLs, stack traces, and sometimes credentials or personal data, so silent external disclosure creates a real data-leak risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The data flow diagram explicitly shows QA reports being sent to external dashboards, bug trackers, and Slack, yet there is no accompanying warning or consent step about external disclosure. Given the skill’s context, the reporter receives logs, screenshots, and failure details from test execution, making outbound transmission materially risky because sensitive operational or proprietary information could be exposed outside the local environment.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill instructs the agent to create and write a manifest under ~/.pilot/setups without any warning that this is a persistent local configuration change and may overwrite an existing setup file. This is risky because it modifies user state on disk, can clobber prior configuration, and may cause later automation to trust or reuse unintended settings.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The reporter role is explicitly designed to send QA reports, logs, screenshots, and related artifacts to external systems such as webhooks, dashboards, bug trackers, and Slack, but the skill provides no privacy, redaction, or disclosure warning. In a QA pipeline, test artifacts often contain sensitive internal URLs, credentials in logs, customer-like test data, or screenshots of nonpublic systems, so silent external transmission increases data leakage risk.

Session Persistence

Medium

• Category: Rogue Agent

Content

pilotctl --json set-hostname <prefix>-<role>
```

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/quality-assurance-pipeline.json << 'MANIFEST'

• Confidence: 91% confidence
• Finding: Write the setup manifest: ```bash mkdir -p ~/.pilot/setups cat > ~/.pilot

VirusTotal

65/65 vendors flagged this skill as clean.