ClawHub
Back to skill

Security audit

Pilot Chat Collaboration Hub Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent chat-hub setup guide, but it forwards and archives all chat content through multiple agents with under-specified trust, retention, and dependency controls.

Review before installing. Use this only in environments where operators and participants understand that chat messages may be moderated, translated, archived, indexed, backed up, and routed across agents. Pin and verify the installed pilot-* skills, manually verify trust relationships, define archive retention and deletion rules, and restrict translation/archival for private or sensitive rooms.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:41
Finding

Unpinned and Unverified Third-Party Skill Installation

Content
View full analysis
-chat # On moderator node clawhub install pilot-event-filter pilot-blocklist pilot-audit-log pilot-alert pilotctl set-hostname -moderator # On translator node clawhub install pilot-translate pilot-stream-data pilot-task-router pilotctl set-hostname -translator # On archive node clawhub install pilot-archive pilot-event-log pilot-backup pilot-cron pilotctl set-hostname -archive-bot ``` ### Technical Analysis The setup instructions install 15 third-party skills by package name without specifying immutable versions, cryptographic digests, verified source locations, or publisher-signature requirements. Consequently, the effective code installed by these commands can differ from the code available when this project was audited. The external skills are assigned capabilities involving message processing, translation, moderation, archival, backups, and scheduled operations. Their implementation is not present in this repository and therefore could not be inspected as part of this audit. If the registry, a publisher account, or dependency resolution process is compromised, a malicious or replaced release could be installed under an expected package name. This finding doe ...[truncated 1931 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The markdown explicitly states that the archive bot 'Archives all conversations for compliance and search,' which affects user data privacy and retention. The document provides setup and usage steps but does not include any warning or disclosure to users/operators about message retention, searchable logs, or backup implications.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The skill instructs operators to configure trust as 'auto-approved when mutual,' which creates an overly permissive trust-establishment model for all connected agents. If an attacker can impersonate a hostname, compromise one node, or socially engineer a handshake, they may gain trusted access to chat, moderation, translation, and archival flows without an explicit human verification step.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

2. Establish trust

All agents trust the chat server. The chat server must handshake each agent, and each agent must handshake the chat server. Auto-approved when mutual.

bash
# chat <-> moderator

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly forwards all chat messages to moderator, translator, and archive agents and instructs archival of all conversations, but it provides no privacy notice, data minimization guidance, consent model, retention limits, or integrity/authentication controls for those message flows. In a collaboration system handling potentially sensitive conversations, this omission can lead to over-collection, undisclosed surveillance, and exposure of message contents across multiple services.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
72% confidence
Finding

Persisting the setup manifest under ~/.pilot/setups creates a local record of hostnames, roles, skills, and communication topology, which may expose operational metadata to other local users or processes if permissions are weak. While this is common configuration behavior, the skill gives no guidance on file permissions, secret avoidance, or lifecycle management, so session/configuration persistence could leak sensitive deployment details.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

clawhub install pilot-archive pilot-event-log pilot-backup pilot-cron

text

**Step 3:** Set hostname and write manifest to `~/.pilot/setups/chat-collaboration-hub.json`.

**Step 4:** All agents handshake the chat server.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The translator role is wired to automatically receive chat messages and send translated content back to the chat server without any documented user preference, locale negotiation, opt-in, or handling of sensitive/private rooms. This can cause unauthorized processing and disclosure of message content, especially where translation uses separate services or where users did not intend their messages to be transformed or redistributed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The translator role states that it translates messages in real time and streams translated content back to the chat server, and the data flow section confirms messages are sent to the translator. Because this behavior moves user message content across components, the skill description should warn about the privacy implications of transmitting message contents for translation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.