T08 · Insecure Dependencies
Warning
- Location
SKILL.md:53- Finding
Unpinned Third-Party Skills Create a Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
Security audit
Pilot Api Gateway Manager Setup
Security checks for vulnerabilities and agentic risk
Overview
The skill is purpose-aligned for API gateway setup, but it asks agents to run broad setup commands with under-scoped trust, dependency, shell-input, and sensitive-log handling controls.
Review this skill before installing. Use it only in a controlled Pilot environment, pin and verify every installed skill, validate the deployment prefix as a simple hostname label, inspect the manifest before writing it, and avoid sending real API keys, bearer tokens, customer identifiers, or unredacted access logs through demo or Slack flows.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:51- Finding
User-Controlled Prefix Is Interpolated into Shell Commands Without Validation
- Content
View full analysis
- ``` ``` Related unquoted substitutions also occur in the handshake and publish examples throughout `SKILL.md` and in the setup commands in `README.md`, including lines 43 and 49-61. ### Technical Analysis The skill explicitly obtains the deployment prefix from the user and subsequently inserts it into Bash commands. It does not define an allowed character set, maximum length, canonicalization process, or shell-safe argument handling. If an agent replaces the placeholder with user input and executes the resulting command through a shell, shell metacharacters in the prefix can terminate or modify the intended command. Characters and constructs such as semicolons, command substitutions, redirections, pipes, or embedded newlines could therefore introduce additional commands. Quoting alone is not a complete defense if command strings are dynamically generated or evaluated. Because the value represents a hostname component, strict validation against a narrow hostname grammar is appropriate. ### Attack Path 1. The skill asks a user to provide a deployment prefix. 2. A malicious or compromised user supplies a prefix containing shell syntax, such as a value that terminates the hostname argument and appends another comman ...[truncated 1358 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
The trust model states that when both sides send a handshake, trust is automatically approved with no manual verification step. In a multi-agent control plane for routing, authentication, and health feedback, this can allow mistaken or spoofed peer establishment if naming, origin validation, or out-of-band verification is weak, potentially granting an attacker influence over routing, auth, or backend deregistration flows.
- Content
2. Establish trust
Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.
bash # discovery <-> router
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README includes example messages that transmit API keys, bearer tokens, client IPs, and client-identifying metadata without any warning to avoid using real secrets or personal data. In an operational API gateway setup, users often copy examples verbatim into shells, logs, chat, or test environments, which can normalize unsafe handling of credentials and increase the risk of secret exposure and privacy leakage.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
pilotctl --json set-hostname -
text **Step 4:** Write the setup manifest: ```bash mkdir -p ~/.pilot/setups cat > ~/.pilot/setups/api-gateway-manager.json << 'MANIFEST'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file instructs the agent to create
~/.pilot/setupsand writeapi-gateway-manager.json, which changes persistent user configuration. The surrounding skill description does not warn the user that local files will be created or overwritten as part of setup.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill defines flows that transmit access logs, client metadata, and alerts between agents and to external systems like Slack without any privacy warning, minimization guidance, or trust-boundary discussion. In an API gateway context, these payloads can contain sensitive operational or customer-identifying data, so silent forwarding increases risk of data leakage or noncompliant handling.
- Content
Static analysis
No suspicious patterns detected.