Pilot Backup Disaster Recovery Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:02 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent backup setup guide, but it needs review because it installs many unpinned helper skills and creates trusted agent links that can move sensitive backup data.

Review this before installing in any real backup environment. Pin and verify every helper skill, confirm peer identities before handshakes, restrict network paths and credentials by role, encrypt backup transfers and storage, and keep Slack or alert messages to non-sensitive summaries.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42

Finding

Unpinned and Unverified Third-Party Skill Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:42-50
Additional Location: README.md:42-58
Vulnerability Type: Supply-chain exposure through mutable, unverified dependencies
Risk Level: Medium

The setup procedure installs twelve named third-party Skills without pinning versions, specifying immutable package digests, validating signatures or checksums, or identifying a verified registry source.

bash

# scheduler:
clawhub install pilot-cron pilot-task-chain pilot-audit-log pilot-slack-bridge
# primary:
clawhub install pilot-backup pilot-archive pilot-compress pilot-share
# secondary:
clawhub install pilot-sync pilot-verify pilot-health pilot-share
# tester:
clawhub install pilot-backup pilot-verify pilot-health pilot-alert

Technical Analysis

Each clawhub install command resolves packages by mutable name alone. Consequently, the code or instructions installed in the future may differ from the versions originally reviewed by the project author. The project provides no lockfile, exact version constraints, content hashes, signature requirements, or vendored dependency source that would allow users to verify what is installed.

The implementations of these dependencies are not included in the audited project, so their behavior cannot be validated from the available files. A registry compromise, maintainer account compromise, malicious package update, or dependency-name takeover could cause an altered Skill to be installed under an expected name.

This is particularly sensitive because the parent Skill permits Bash usage and the dependencies are intended to interact with databases, filesystems, backup archives, synchronization services, Slack, alerts, and inter-agent file transfers.

Attack Path

1. An attacker compromises a listed package, its publisher account, or the package distribution infrastructure.
2. The attacker publishes a malicious release under one of the expected package ...[truncated 1376 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to an exact, reviewed version rather than resolving only by package name.
2. Prefer immutable content digests and require clawhub to reject packages whose contents do not match the approved digest.
3. Verify cryptographic publisher signatures and document the trusted registry or repository for every dependency.
4. Add a dependency lockfile or equivalent manifest containing package names, versions, source identities, hashes, and review dates.
5. Audit the full contents and transitive dependencies of every installed Skill before approving it for backup infrastructure.
6. Use an internal mirror or allowlisted registry populated only with reviewed artifacts.
7. Run installed Skills with least privilege. Restrict filesystem access, credentials, network destinations, and Bash capabilities to what each role requires.
8. Separate production backup credentials from restore-testing and notification credentials to limit compromise scope.
9. Monitor dependency integrity and require explicit security review before updating pinned versions.
10. Update both SKILL.md and README.md so users cannot bypass these controls by following alternate installation instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file documents compressing, archiving, syncing, and restoring backups across multiple sites, which inherently involves user or system data and can affect privacy and system integrity. The description provides setup and execution steps but does not include any warning about sensitive contents of backups, secure storage, encryption, access control, or care when restoring production data.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The trust model auto-approves communication once both sides exchange handshakes, with no manual verification of identity or out-of-band confirmation. If an attacker can spoof names, induce reciprocal handshakes, or gain temporary access to one node, they may establish trusted links and receive backup data or inject control messages into the backup workflow.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# scheduler <-> primary

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs deployment of multi-host backup, restore-testing, and Slack reporting workflows, but it does not warn that backup archives, restore metadata, and operational status may contain sensitive data in transit or in notifications. In a disaster-recovery context, these flows commonly include databases, file archives, hostnames, job identifiers, and verification results, so omitting transport, access-control, and data-minimization warnings can lead operators to expose sensitive backup material or leak operational details to third-party messaging systems.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

clawhub install pilot-backup pilot-verify pilot-health pilot-alert

text

**Step 3:** Set hostname and write manifest to `~/.pilot/setups/backup-disaster-recovery.json`.

**Step 4:** Handshake along the chain: scheduler↔primary↔secondary↔tester↔scheduler.

Static analysis

No suspicious patterns detected.