Pilot Api Gateway

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:27 AM UTC
• Version: 1.0.0

Overview

This skill intentionally exposes local APIs to remote Pilot agents, but its public gateway example lacks access-control guidance and contains an unsafe shell variable bug.

Review this skill carefully before installing. Use it only for authenticated, least-privilege local APIs, avoid exposing admin or private localhost services, add sender and route allowlists, and fix the example by renaming the request path variable before using the workflow.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:73

Finding

Remote Request Path Overwrites the Shell Executable Search Path

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73-90
Vulnerability Type: Request-controlled environment variable manipulation
Risk Level: Medium

Vulnerable Code

bash

while true; do
  REQUEST=$(pilotctl --json recv 80 --timeout 120s)
  METHOD=$(echo "$REQUEST" | jq -r '.method // "GET"')
  PATH=$(echo "$REQUEST" | jq -r '.path // "/"')
  SENDER=$(echo "$REQUEST" | jq -r '.sender')

  case "$METHOD:$PATH" in
    "GET:/api/status")
      RESPONSE='{"status":"ok"}'
      ;;
    "GET:/api/users")
      RESPONSE='[{"id":1,"name":"Alice"}]'
      ;;
    *)
      RESPONSE='{"error":"not found"}'
      ;;
  esac

  pilotctl --json send-message "$SENDER" --data "$RESPONSE"
done

Technical Analysis

The script stores the remotely supplied .path request field in the special Bash variable PATH. In Bash, PATH controls the directories searched when resolving executable names.

Assigning untrusted request data to this variable changes how all subsequent commands are resolved. The final pilotctl command—and commands executed during later loop iterations—will be searched for using the attacker-provided value rather than the process's trusted executable search path.

A normal API path such as /api/status is not a valid search path containing the required binaries. Consequently, the shell will generally fail to locate pilotctl, disrupting request processing. If an attacker can also place an executable named pilotctl in a directory selected through the request, the script can invoke that substituted executable with the privileges of the user running the gateway.

Attack Path

1. The operator starts the example public daemon and listener.
2. A remote client sends a request containing an attacker-selected .path value.
3. The statement PATH=$(...) replaces the shell's executable search path.
4. The route selection completes using the modified value.
5. The s ...[truncated 1181 chars]

Remediation

View remediation

Remediation Suggestions

1. Rename the request variable so it does not collide with Bash's special PATH variable:

   bash

   REQUEST_PATH=$(echo "$REQUEST" | jq -r '.path // "/"')
   

2. Use the renamed variable in route matching:

   bash

   case "$METHOD:$REQUEST_PATH" in
   

3. Initialize a restricted executable search path before processing requests:

   bash

   readonly PATH='/usr/local/bin:/usr/bin:/bin'
   export PATH
   

4. Resolve trusted dependencies before entering the loop and invoke them through verified absolute paths where practical:

   bash

   PILOTCTL=$(command -v pilotctl) || exit 1
   JQ=$(command -v jq) || exit 1
   readonly PILOTCTL JQ
   

5. Validate request fields before use. Restrict API paths to the expected syntax and reject values containing control characters or other malformed content.

6. Run the gateway under a dedicated, unprivileged operating-system account with minimal filesystem permissions. This limits the impact if command substitution or tool hijacking becomes possible.

7. Add explicit error handling so failures from recv, jq, or send-message are logged and do not leave the gateway in an invalid state.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly exposes local APIs to remote Pilot agents, but the command section does not clearly warn that this can make a locally running service reachable by external parties on the Pilot network. That omission increases the chance a user will expose sensitive internal services, admin endpoints, or unauthenticated local APIs under the mistaken assumption that they remain private to the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow example starts the daemon with --public and then processes remote requests in a loop, but provides no warning that the example creates externally reachable functionality and may disclose data to untrusted remote clients. Because it normalizes incoming method/path values and returns responses over messaging without any authentication, authorization, rate limiting, or validation guidance, users may copy this pattern and unintentionally expose sensitive services or create an attack surface for abuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.