Pilot Ai Tutoring System Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:58 AM UTC
• Version: 1.0.0

Overview

The skill appears to set up the advertised tutoring-agent system, but it needs Review because it configures trusted multi-agent learner-data sharing and shell-based setup without enough validation or safeguards.

Install only after reviewing the named dependency skills and confirming trusted versions. Use a simple validated prefix such as letters, numbers, underscores, or hyphens only; verify peer hostnames before handshakes; avoid real learner identifiers in examples; and define consent, access control, retention, and cleanup practices for learner progress data and the ~/.pilot setup manifest.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:33

Finding

Shell Command Injection Through Unvalidated Deployment Prefix

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:33, SKILL.md:46-48, and SKILL.md:154-165
Vulnerability Type: Command injection through unquoted, user-controlled shell input
Risk Level: High

The Skill instructs the agent to request a deployment prefix from the user and interpolate that value directly into Bash commands without validation or shell-safe argument handling.

markdown

**Step 1:** Ask the user which role this agent should play and what prefix to use.

The prefix is subsequently inserted into commands such as:

bash

pilotctl --json set-hostname <prefix>-<role>
mkdir -p ~/.pilot/setups

It is also used without quoting in the handshake commands:

bash

# content-curator <-> tutor:
pilotctl --json handshake <prefix>-tutor "setup: ai-tutoring-system"
pilotctl --json handshake <prefix>-content-curator "setup: ai-tutoring-system"
# tutor <-> assessor:
pilotctl --json handshake <prefix>-assessor "setup: ai-tutoring-system"
pilotctl --json handshake <prefix>-tutor "setup: ai-tutoring-system"
# assessor <-> content-curator:
pilotctl --json handshake <prefix>-content-curator "setup: ai-tutoring-system"
pilotctl --json handshake <prefix>-assessor "setup: ai-tutoring-system"

Technical Analysis

The Skill grants access to Bash and explicitly asks for a user-supplied prefix. No character allowlist, length restriction, normalization rule, or shell escaping requirement is specified before the prefix is substituted into commands.

If an agent performs textual substitution and invokes the resulting command through a shell, metacharacters in the prefix—such as semicolons, command substitutions, redirection operators, or logical operators—can alter command structure. Quoting alone would reduce some risks, but strict validation and argument-array execution are preferable.

The role placeholder should also be r ...[truncated 1388 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate the prefix before any use with a strict allowlist, such as ^[A-Za-z0-9][A-Za-z0-9_-]{0,62}$.
2. Reject prefixes containing whitespace, shell metacharacters, path separators, control characters, command substitutions, or leading hyphens.
3. Restrict the role to the exact enumerated values content-curator, tutor, or assessor.
4. Avoid constructing command strings. Invoke pilotctl using an argument array or an execution API that does not pass values through shell parsing.
5. If Bash is unavoidable, validate first, use -- where supported, and quote every substituted value, for example:

   bash

   pilotctl --json set-hostname -- "${prefix}-${role}"
   pilotctl --json handshake -- "${prefix}-tutor" "setup: ai-tutoring-system"
   

6. Display the normalized hostname to the user and request confirmation before executing state-changing commands.
7. Apply the same validation requirements to every command in SKILL.md and README.md that uses the deployment prefix.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Third-Party Skill Installation Creates Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:35-42 and README.md:37-49
Vulnerability Type: Mutable, unverified third-party dependencies
Risk Level: Medium

The setup instructions install nine third-party Skills using package names only:

bash

# For content-curator:
clawhub install pilot-archive pilot-discover pilot-dataset
# For tutor:
clawhub install pilot-chat pilot-task-router pilot-receipt
# For assessor:
clawhub install pilot-metrics pilot-alert pilot-audit-log

The corresponding README instructions also install the same dependencies without versions or integrity metadata:

bash

# On server 1 (content curator)
clawhub install pilot-archive pilot-discover pilot-dataset
pilotctl set-hostname <your-prefix>-content-curator

# On server 2 (tutor agent)
clawhub install pilot-chat pilot-task-router pilot-receipt
pilotctl set-hostname <your-prefix>-tutor

# On server 3 (assessment agent)
clawhub install pilot-metrics pilot-alert pilot-audit-log
pilotctl set-hostname <your-prefix>-assessor

Technical Analysis

The dependency references do not specify audited versions, immutable content digests, signatures, expected publishers, or integrity hashes. Consequently, the effective dependency content can change after this Skill has been reviewed.

If a registry account, publishing pipeline, package namespace, or dependency release is compromised, a later setup can resolve the same package name to modified content. The project also provides no explicit instruction to inspect dependency manifests, requested tools, scripts, or permissions before enabling them.

This finding concerns supply-chain exposure; the audited files do not prove that any named dependency is currently malicious.

Attack Path

1. An attacker compromises a named dependency's publisher account, release process, or registry namespace.
2. The attacker publishes a malicious or otherwise un ...[truncated 1037 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to a reviewed, immutable version or content digest supported by ClawHub.
2. Record expected publisher identities, signatures, and integrity hashes in the setup documentation or a lock file.
3. Verify signatures and hashes before installation and fail closed when verification is unavailable or unsuccessful.
4. Review each dependency's instructions, scripts, tool permissions, network behavior, and transitive dependencies before deployment.
5. Use a trusted private mirror or an approved-package allowlist for production installations.
6. Test dependencies in an isolated, least-privileged environment before enabling them on systems containing learner data.
7. Establish a controlled update process so dependency changes require review rather than being adopted automatically by package name.
8. Keep the pinned dependency references synchronized between SKILL.md and README.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README explicitly instructs routing learner responses and progress data between multiple agents but provides no guidance on consent, minimization, retention, or protection of potentially sensitive educational data. In a tutoring context, this can expose personal performance information across services without users understanding how their data is handled.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The trust model auto-approves communication once both sides exchange handshakes, with no documented human verification, identity validation, or secondary approval step. If an operator targets the wrong host or a spoofed agent name is used, unauthorized trust relationships could be established and sensitive curriculum or learner data could be exchanged automatically.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# content-curator <-> tutor (lesson delivery)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The skill directs the agent to change hostname state and create a persistent manifest under ~/.pilot/setups, which alters local session/environment state beyond a transient task. While this persistence is part of legitimate setup behavior, it can surprise users, leave residual configuration on disk, and create a durable record of peer topology and workflow metadata.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

clawhub install pilot-metrics pilot-alert pilot-audit-log

text

**Step 3:** Set the hostname and write the manifest:
```bash
pilotctl --json set-hostname <prefix>-<role>
mkdir -p ~/.pilot/setups

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the operator to configure agents that exchange learner responses, progress, and gap-analysis data and to write persistent local setup files, but it does not include any privacy, retention, or consent warnings. In an educational context, learner identifiers and performance data may be sensitive, so omission of safeguards can lead to unintended disclosure or noncompliant handling of personal data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.