Pilot Autonomous Warehouse Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:02 AM UTC
• Version: 1.0.0

Overview

The skill fits a warehouse setup workflow, but it gives agents high-impact setup and messaging authority without enough scoping around trust, dependencies, payment escrow, and data sharing.

Review this skill carefully before installing. Use it only in a controlled test or least-privileged warehouse environment, pin and verify every installed dependency, validate the deployment prefix as a hostname-safe value, confirm peer identities manually, and avoid enabling the payment-escrow role unless that financial workflow is explicitly required and separately reviewed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48

Finding

Unpinned Third-Party Skill Installation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:42

Finding

Unvalidated User-Controlled Prefix Used in Shell Commands

Content

View full analysis

` with a unique name for your deployment (e.g. `acme`). ### 1. Install skills on each server ```bash # On fleet controller node clawhub install pilot-task-router pilot-load-balancer pilot-cron pilotctl set-hostname -fleet-controller # On inventory brain node clawhub install pilot-dataset pilot-metrics pilot-consensus pilotctl set-hostname -inventory-brain # On pick optimizer node clawhub install pilot-task-parallel pilot-event-filter pilot-escrow pilotctl set-hostname -pick-optimizer # On dock manager node clawhub install pilot-webhook-bridge pilot-receipt pilot-audit-log pilotctl set-hostname -dock-manager ``` ``` The same prefix is subsequently placed into unquoted `pilotctl handshake` and `pilotctl publish` command arguments in `README.md:70-120`. `SKILL.md:46` explicitly directs the agent to ask the user for this prefix, while `SKILL.md:55` directs it to set the hostname and create the manifest. ### Technical Analysis The deployment prefix originates from user input and is inserted into shell command positions without a documented validation rule or safe argument-encoding requirement. If an autonomous agent implements the instructions by performing direct textual replacement and then passes the resulting command to a shell, shell metacharacters in the prefix can change the command's syntax. For example, characters such as semicolons, command substitutions, redirection operators, or newline characters may terminate the intended argument and introduce additional shell operations. Quoting alone is not sufficient if substitution is performed unsafely; strict validation and execution through an argument-array API are preferable. The documentation does not its ...[truncated 1908 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The pick-optimizer role includes payment escrow coordination and installs the unrelated pilot-escrow skill in a warehouse orchestration setup. Introducing financial/escrow capability into an inventory and robot-control workflow violates least privilege and expands the attack surface, creating a pathway for misuse of a component that has no clear operational need in this context.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The trust model auto-approves communication when both sides send a handshake, with no manual verification or stronger identity validation step described. In a multi-agent warehouse environment controlling robot dispatch, inventory, and shipping events, this can allow unauthorized or spoofed peers to become trusted if naming or endpoint controls are weak, enabling false commands, bad inventory updates, or shipment manipulation.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# fleet-controller <-> inventory-brain (robot status)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The skill directs the agent to persist a manifest under ~/.pilot/setups/autonomous-warehouse.json, creating session-persistent local state that may include hostnames, role assignments, peer names, ports, and workflow topology. While this is a normal setup action, storing configuration persistently without an explicit notice or guidance on permissions/cleanup can leak sensitive operational details to later sessions, other local users, or downstream tooling.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

clawhub install pilot-webhook-bridge pilot-receipt pilot-audit-log

text

**Step 3:** Set the hostname and write the manifest to `~/.pilot/setups/autonomous-warehouse.json`.

**Step 4:** Tell the user to initiate handshakes with the peers for their role.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs agents to publish operational warehouse data between peers and to use a webhook bridge to notify carriers, but it never warns the user that order, inventory, robot-status, and shipment data will be transmitted off-process or potentially to external systems. In this context, the omission matters because the workflow includes concrete cross-host messaging and carrier-facing notifications, which can expose sensitive operational metadata if users are not prompted to review destinations, trust boundaries, and data sensitivity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.