Pilot Brand Protection Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:00 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent brand-protection setup, but it enables high-impact takedown/reporting workflows without enough approval, scoping, or dependency controls.

Install only after reviewing the referenced role skills and pinning trusted versions where possible. Use a simple allowlisted prefix, verify peer identities before handshakes, restrict Slack/webhook recipients, and require manual review before any DMCA, platform report, or cease-and-desist request is submitted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:48

Finding

Unvalidated Deployment Prefixes Can Cause Shell or Configuration Injection

Content

View full analysis

- ``` ```bash mkdir -p ~/.pilot/setups cat > ~/.pilot/setups/brand-protection.json << 'MANIFEST' MANIFEST ``` From `SKILL.md:146-158`: ```bash # scanner <-> classifier: pilotctl --json handshake -classifier "setup: brand-protection" pilotctl --json handshake -scanner "setup: brand-protection" # classifier <-> enforcer: pilotctl --json handshake -enforcer "setup: brand-protection" pilotctl --json handshake -classifier "setup: brand-protection" # enforcer <-> dashboard: pilotctl --json handshake -dashboard "setup: brand-protection" pilotctl --json handshake -enforcer "setup: brand-protection" ``` From `README.md:43-65`: ```bash # On server 1 (brand scanner) clawhub install pilot-stream-data pilot-cron pilot-archive pilotctl set-hostname -scanner # On server 2 (threat classifier) clawhub install pilot-event-filter pilot-task-router pilot-metrics pilotctl set-hostname -classifier # On server 3 (takedown enforcer) clawhub install pilot-webhook-bridge pilot-audit-log pilot-receipt pilotctl set-hostname -enforcer # On server 4 (brand dashboard) clawhub install pilot-metrics pilot-slack-bridge pilot-announce pilotctl set-hostname -dashboard ``` From `README.md:78-92`: ```ba ...[truncated 2896 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Third-Party Skills Are Installed Without Version or Integrity Pinning

Content

View full analysis

-scanner # On server 2 (threat classifier) clawhub install pilot-event-filter pilot-task-router pilot-metrics pilotctl set-hostname -classifier # On server 3 (takedown enforcer) clawhub install pilot-webhook-bridge pilot-audit-log pilot-receipt pilotctl set-hostname -enforcer # On server 4 (brand dashboard) clawhub install pilot-metrics pilot-slack-bridge pilot-announce pilotctl set-hostname -dashboard ``` ### Technical Analysis The installation commands identify dependencies only by mutable package names. The project does not specify reviewed versions, immutable content digests, package signatures, publisher identities, or an approved registry endpoint. Consequently, the effective code installed during deployment can differ from the code that was originally reviewed. Registry compromise, package ownership transfer, dependency confusion, typosquatting in a modified instruction, or a malicious future release could introduce unsafe behavior. The dependency roles have security-sensitive capabilities. They include scheduled execution, data archival, webhook integration, Slack publishing, audit logging, and enforcement workflows. A compromised dependency could therefore obtain useful access to collected evidence, outbound ...[truncated 1307 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly describes filing DMCA notices, platform reports, and cease-and-desist requests, which are externally impactful and can be difficult to reverse once sent. Without an explicit warning, approval gate, or operator confirmation step, users may deploy a workflow that performs legal/enforcement actions automatically on imperfect classifications, leading to wrongful takedowns or legal exposure.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The README says trust is 'auto-approved' once both sides send a handshake, with no manual verification step. In a multi-agent system performing scanning, classification, and enforcement, this increases the risk of misbinding trust to the wrong peer due to naming mistakes, spoofed endpoints, or unsafe automation, enabling unauthorized data exchange or action triggering.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# scanner <-> classifier

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

Writing ~/.pilot/setups/brand-protection.json creates durable session state on disk, which can influence later runs and persist sensitive operational configuration such as hostnames, peers, and data flows. Although expected for a setup skill, persistent state becomes risky when users are not clearly informed or when teardown is not provided, especially in multi-tenant or shared environments.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/brand-protection.json << 'MANIFEST'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifests and data-flow documentation clearly enable outbound transmission of violation data and reports to peers and external destinations, including Slack/webhooks on port 443, but the skill description does not prominently warn users about third-party data sharing. In a brand-protection workflow, this could expose sensitive evidence, enforcement details, or monitored content to external systems without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The data flow states that brand health reports are sent to external stakeholders, but the skill does not warn that reports may contain sensitive monitoring results, enforcement status, or third-party information. This can cause unintended disclosure if recipients, report contents, or transport controls are not carefully restricted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to write a persistent manifest into ~/.pilot/setups without explicitly warning the user that it will modify files in their home directory. While this is part of the intended setup flow, silent persistence can surprise users, alter future agent behavior, and create configuration residue that remains after the session ends.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.