ClawHub
Back to skill

Security audit

Pilot Auto Trust

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly about automating trust decisions, but it gives broad bulk-approval commands for security-sensitive agent trust without enough confirmation or scoping.

Review this skill carefully before installing in any real Pilot Protocol environment. Use it only where automated trust changes are acceptable, and prefer running the pending/listing commands first, verifying node identities through stronger signals, and adding an explicit confirmation step before any bulk approve or reject operation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

The skill is explicitly designed to make autonomous trust decisions, including auto-approving handshake requests based on policy. While that is the feature, it is security-relevant because trust establishment is a privileged action and delegating it to simplistic automated criteria can admit malicious or impersonating agents.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md
Automatic trust management with configurable policies for Pilot Protocol agents.

  Use this skill when:
  1. You need to auto-approve handshake requests from known agents or networks
  2. You want policy-based trust decisions (e.g., auto-trust high polo scores)
  3. You need to batch-process pending trust requests

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill provides bulk approve/reject trust-management commands that directly alter security relationships without prominent warnings, confirmation steps, or guidance on validating pending requests first. In this context, automated trust approval is security-sensitive because weak selectors such as score thresholds, network prefixes, or hostname patterns can be spoofed or misapplied, leading to unauthorized agents being trusted at scale.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
96% confidence
Finding

This example auto-approves any pending node with polo_score >= 50, creating a fully automated trust path from a single reputation metric to approval. If the score can be gamed, stale, or insufficiently representative, malicious nodes may be trusted automatically and gain access or privileged protocol standing.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

pilotctl --json pending

text

### Auto-Approve by Polo Score
```bash
pilotctl --json pending | jq -r '.[] | select(.polo_score >= 50) | .node_id' | \
  xargs -I {} pilotctl --json approve {}

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

This workflow auto-approves based only on an address prefix, which is a weak and potentially attacker-controlled attribute depending on the protocol and deployment model. Bulk trusting nodes by network pattern can accidentally approve unauthorized systems and is especially dangerous because it scales the mistake across all pending requests.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

xargs -I {} pilotctl --json approve {}

text

### Auto-Approve by Network
```bash
pilotctl --json pending | jq -r '.[] | select(.address | startswith("1:")) | .node_id' | \
  xargs -I {} pilotctl --json approve {}

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

This example trusts agents automatically if their hostname matches '^agent-prod-', but hostnames are commonly mutable, spoofable, or weak identifiers unless backed by authenticated inventory. Using naming convention alone for trust establishment can let attackers craft matching identities and become trusted automatically.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

xargs -I {} pilotctl --json approve {}

text

### Auto-Approve by Hostname Pattern
```bash
pilotctl --json pending | jq -r '.[] | select(.hostname | test("^agent-prod-")) | .node_id' | \
  xargs -I {} pilotctl --json approve {}

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

The workflow script operationalizes autonomous trust by approving nodes in a loop and rejecting others in bulk, making security decisions without per-request human validation. Even though it combines score and hostname checks, those are still policy heuristics that can produce false trust or false rejection at scale, amplifying operational and security impact.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

bash
#!/bin/bash
# Auto-approve production agents with high reputation

PENDING=$(pilotctl --json pending)

Static analysis

No suspicious patterns detected.