Security audit

Pilot Agent Marketplace Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate marketplace setup guide, but it asks agents to run broad install and setup commands with under-specified safety controls.

Review before installing. Use a strict hostname-safe prefix, quote generated arguments, confirm the full hostname and handshake list before running commands, and prefer pinned or verified versions of the dependent skills. Run setup from a least-privileged account and check whether ~/.pilot/setups/agent-marketplace.json already exists before writing it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:47
Finding: Unpinned Third-Party Skill Installation Creates Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: README.md:43
Finding: User-Controlled Prefix Is Interpolated into Shell Commands Without Validation or Quoting
Content: View full analysis
` with a unique name for your deployment (e.g. `acme`). ### 1. Install skills on each server ```bash # On directory node clawhub install pilot-directory pilot-announce-capabilities pilot-discover pilot-reputation pilotctl set-hostname -directory # On matchmaker node clawhub install pilot-matchmaker pilot-auction pilot-priority-queue pilot-audit-log pilotctl set-hostname -matchmaker # On escrow node clawhub install pilot-escrow pilot-receipt pilot-audit-log pilot-webhook-bridge pilotctl set-hostname -escrow # On gateway node clawhub install pilot-api-gateway pilot-health pilot-load-balancer pilot-metrics pilotctl set-hostname -gateway ``` ``` The same unquoted prefix is also used in handshake and publish commands, including: ```bash pilotctl handshake -matchmaker "marketplace" pilotctl publish -matchmaker capability-request '{"requester":"client-a","need":"image-classification","budget":50}' ``` ### Technical Analysis The skill explicitly asks the user to provide a deployment prefix and then places that value into Bash command positions. No input validation, canonicalization, or quoting requirement is defined. If an AI agent performs textual substitution and executes the resulting command through Bash, shell metacharacters contained in the prefix can be interpreted as command syntax rather than as part of a hostname. Relevant syntax includes command separators, pipelines, redirections, command substitution, and whitespace that creates additional arguments. Quoting alone is not a complete hostname-validation strategy, but it prevents shell parsing when values are passed ...[truncated 1757 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 87% confidence
Finding: The README describes a trust model where mutual handshakes automatically establish trust with no manual approval or independent verification. If an attacker can trigger or spoof a reciprocal handshake, agents may form trusted relationships too easily, enabling unauthorized message exchange and expansion of attack paths across marketplace components.
Content: Scanner excerpt · README.md (reported line 64)May include surrounding context.
2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash
# gateway <-> matchmaker

Session Persistence