Back to skill
Skillv1.0.0
ClawScan security
Pilot Quarantine · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 9, 2026, 7:27 AM
- Verdict
- suspicious
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's instructions broadly match its stated purpose (isolating agents), but the metadata omits dependencies and config paths that the runtime steps clearly require and modify — this mismatch and the file-write behavior warrant caution before installing.
- Guidance
- This skill appears to do what it says (use pilotctl to isolate agents) but has metadata inconsistencies you should resolve before installing. Actionable steps: 1) Verify the pilotctl binary is the trusted upstream binary from Pilot Protocol, and that the local daemon behavior (untrust/disconnect/handshake) matches your expectations. 2) Confirm jq and openssl (and standard shell tools) are available — the SKILL.md uses them but they are not listed in the registry metadata. 3) Expect the skill to create and modify files under ~/.pilot/quarantine/; inspect those files and set appropriate filesystem permissions. 4) Avoid supplying untrusted input for AGENT or QUARANTINE_ID to prevent command/record injection; prefer a vetted UI or strict validation. 5) Ask the publisher to update the skill metadata to list all required binaries (jq, openssl, date/mv are commonly available) and to declare the config path (~/.pilot/quarantine) so you can audit and control its persistent state. If you cannot verify pilotctl's provenance or the missing metadata is not corrected, do not install in production.
Review Dimensions
- Purpose & Capability
- noteThe skill's name and description describe quarantining Pilot Protocol agents and the SKILL.md contains pilotctl commands to untrust/disconnect agents — this is coherent. However, the registry metadata only declares pilotctl as a required binary while the instructions also require jq and openssl and assume a ~/.pilot/quarantine path; those omissions are inconsistent with the stated purpose and expected setup.
- Instruction Scope
- concernRuntime instructions read and write files under ~/.pilot/quarantine (creating active and resolved JSON records) and run pilotctl commands that disconnect/untrust agents. The SKILL.md references filesystem paths and uses external binaries (jq, openssl, date, mv) but the declared requirements did not list those. The skill will modify user home state and perform network/control actions via pilotctl; the instructions do not limit input validation for AGENT/QUARANTINE_ID and could be misused if those variables come from untrusted sources.
- Install Mechanism
- okThis is an instruction-only skill with no install spec and no archive downloads — low installation risk. Nothing will be written by an installer, although runtime commands do write files.
- Credentials
- okNo environment variables or credentials are requested. The skill relies on a local pilotctl daemon and on local binaries; that is proportionate to the stated task. Still, it modifies local quarantine records in the user's home directory which is a type of persistent state that should be expected and declared.
- Persistence & Privilege
- noteThe skill does not request always:true and does not alter other skills, but it creates and maintains persistent records under ~/.pilot/quarantine. The metadata did not declare these required config paths; installation should disclose that it writes to the user's home directory so operators can review and control file permissions.