ClawHub
Back to skill

Security audit

Pilot Ad Campaign Manager Setup

Security checks for vulnerabilities and agentic risk

Overview

This setup skill matches its stated ad-campaign automation purpose, but it needs Review because it installs many unpinned skills and gives unsafe setup instructions for a sensitive budget-and-reporting workflow.

Review this carefully before installing. Use only trusted, pinned versions of the dependent skills; validate the deployment prefix as a simple hostname-safe value; manually verify peer identities before handshakes; and confirm exactly where Slack/webhook campaign reports will be sent before enabling the analyst role.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:44
Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44-58; duplicated in README.md, lines 44-62
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: High

Vulnerable Code:

bash
# strategist:
clawhub install pilot-task-router pilot-dataset pilot-cron
# creative:
clawhub install pilot-share pilot-task-parallel pilot-receipt
# bidder:
clawhub install pilot-metrics pilot-stream-data pilot-escrow
# analyst:
clawhub install pilot-event-filter pilot-slack-bridge pilot-webhook-bridge

Technical Analysis

The setup procedure installs twelve third-party skills by package name without specifying immutable versions, cryptographic digests, trusted publisher identities, or signature-verification requirements. Consequently, the code installed during deployment may differ from the dependencies that existed when this project was reviewed.

This is particularly significant because the dependencies are intended to process campaign budgets, audience information, creative assets, real-time auction data, Slack messages, webhooks, and external reports. A compromised registry account, malicious package update, dependency substitution, or unsafe package source could introduce arbitrary behavior into the deployment.

The project contains no executable implementation of these dependencies, so their safety cannot be established from the audited files.

Attack Path

  1. An attacker compromises a publisher account, registry entry, distribution source, or one of the named packages.
  2. The attacker publishes a malicious or backdoored release under a dependency name used by the setup procedure.
  3. A user or agent follows the documented setup instructions and runs clawhub install without a version or digest constraint.
  4. clawhub resolves and installs the attacker-controlled release.
  5. The installed dependency executes with the permissions available to the invoking agent and gai ...[truncated 870 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every dependency to an immutable, reviewed version or content digest rather than installing by name alone.
  2. Require cryptographic signature and checksum verification before installation.
  3. Document the expected registry and trusted publisher identity for every dependency.
  4. Reject packages resolved from unofficial mirrors, alternate registries, or unexpected namespaces.
  5. Generate and retain a dependency lock file or equivalent deployment manifest containing exact versions and hashes.
  6. Audit each dependency and its transitive dependencies before approving deployment.
  7. Run installed skills with least privilege and isolate high-impact capabilities such as budget management, Slack access, and outbound webhooks.
  8. Add an explicit user confirmation step that displays the resolved versions, publishers, permissions, and integrity information before installation.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:42
Finding

Unvalidated User-Controlled Prefix Is Interpolated into Shell Commands

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42 and 60-63, with additional command interpolation at lines 118-129; duplicated in README.md, lines 42, 48-61, and 69-90
Vulnerability Type: Potential shell command injection
Risk Level: High

Vulnerable Code:

markdown
**Step 1:** Ask the user which role this agent should play and what prefix to use.

**Step 3:** Set the hostname:
```bash
pilotctl --json set-hostname <prefix>-<role>
text

Additional vulnerable command templates include:

```bash
pilotctl --json handshake <prefix>-creative "setup: ad-campaign-manager"
pilotctl --json handshake <prefix>-strategist "setup: ad-campaign-manager"
pilotctl --json handshake <prefix>-bidder "setup: ad-campaign-manager"
pilotctl --json handshake <prefix>-analyst "setup: ad-campaign-manager"

Technical Analysis

The skill instructs the agent to obtain a prefix from the user and substitute it directly into Bash commands. No validation rule, maximum length, hostname grammar, escaping procedure, or requirement to use a non-shell process API is provided. The substituted value is also not enclosed in shell-safe quoting.

If an agent replaces the placeholder verbatim and invokes the resulting text through a shell, metacharacters embedded in a malicious prefix can terminate or alter the intended command and introduce additional commands. The same prefix is reused in hostname, handshake, subscription, and publication commands, creating multiple potential execution points.

For example, a prefix containing a command separator could transform a hostname operation into more than one shell command. The precise payload and resulting privileges depend on the shell and on the permissions under which setup is performed.

Attack Path

  1. The setup agent asks a user or an untrusted upstream source to provide a deployment prefix.
  2. The attacker supplies a prefix ...[truncated 1204 chars]
Remediation
View remediation

Remediation Suggestions

  1. Validate the prefix before use with a strict hostname-compatible allowlist, such as ^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$.
  2. Reject whitespace, shell metacharacters, path separators, leading hyphens, control characters, Unicode lookalikes, and values exceeding the permitted hostname length.
  3. Validate the role independently against the fixed set strategist, creative, bidder, and analyst.
  4. Avoid constructing shell command strings. Invoke pilotctl through a process API that passes each argument as a separate array element.
  5. If shell execution cannot be avoided, apply robust shell quoting after validation and use -- where supported to terminate option parsing.
  6. Display the normalized hostname to the user and require confirmation before executing setup or trust commands.
  7. Apply the same validation to every use of the prefix in hostname, handshake, subscription, publication, and manifest-generation operations.
  8. Add tests covering separators, command substitution, quotes, newlines, leading options, oversized values, and invalid hostname characters.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly routes campaign reports to external systems and includes Slack/webhook bridge capabilities, but it provides no warning that campaign data, performance metrics, or potentially sensitive business information may leave the trusted agent boundary. In an advertising workflow, this can lead to unintended disclosure to third-party services, misconfigured endpoints, or oversharing to stakeholder channels without operator awareness.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

The README states that trust is automatically approved once both sides send handshakes, with no manual verification step. In a multi-agent deployment handling budgets, bidding, and reporting, this weakens trust establishment because operators may connect the wrong peer, trust a spoofed hostname, or create unintended agent links that can exchange commands and data automatically.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash
# strategist <-> creative

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The skill instructs the agent to persist a setup manifest under ~/.pilot/setups, creating state that survives the current session. Persistent manifests can retain sensitive operational details such as hostnames, peers, data flows, and integration topology, which may later be read or reused without the user's awareness.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/ad-campaign-manager.json << 'MANIFEST'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly configures an analyst role to send campaign reports to an external destination via webhook/Slack bridge, but it does not warn the user that campaign data may be transmitted to third-party systems. In an advertising workflow, those reports can contain commercially sensitive performance data or user-derived metrics, so silent external transmission increases the risk of unintended data disclosure and compliance violations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.