Pilot Ci Cd Pipeline Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:58 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent CI/CD setup guide, but it enters Review because it installs mutable helper skills and establishes production-capable agent trust/data flows without enough guardrails.

Install only after reviewing the exact helper skill versions and publishers, using a safe hostname prefix, and confirming the trust relationships and deployment/webhook targets. Treat this as production-affecting CI/CD configuration, not just a local setup helper.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45

Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45-50; duplicated in README.md, lines 39-49
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The setup procedure installs third-party skills by mutable package name without specifying reviewed versions, immutable digests, checksums, or publisher-verification requirements.

bash

# For ci-builder:
clawhub install pilot-task-router pilot-share pilot-github-bridge
# For ci-tester:
clawhub install pilot-task-router pilot-share pilot-audit-log
# For ci-deployer:
clawhub install pilot-task-router pilot-share pilot-webhook-bridge pilot-receipt

Technical Analysis

Each clawhub install command resolves dependencies using only a package name. Consequently, the installed content can differ from the content that existed when this project was audited. A compromised registry account, malicious future release, namespace takeover, or dependency-resolution attack could cause an Agent to install unreviewed code.

The affected skills perform security-sensitive CI/CD functions, including artifact transfer, GitHub webhook handling, audit logging, post-deployment webhooks, and deployment receipts. The project does not direct the Agent to inspect resolved package metadata, validate publisher identity, verify a checksum, or obtain explicit approval for a resolved version before installation.

Attack Path

1. An attacker compromises a publisher or registry account associated with one of the named skills, or otherwise causes a malicious release to resolve under that name.
2. A user asks the Agent to configure one of the documented CI/CD roles.
3. The Agent follows the setup instructions and executes the unpinned clawhub install command.
4. clawhub resolves and installs the attacker-controlled release.
5. When the installed skill is loaded or invoked, it operates in the corresponding CI/CD role and can abuse whatever tools, files, credent ...[truncated 702 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every installed skill to an explicitly reviewed version or, preferably, an immutable content digest.
• Verify package signatures, publisher identity, and checksums before installation.
• Maintain an allowlist mapping each dependency name to its approved publisher and immutable digest.
• Resolve and display the exact package version before installation, then require explicit user approval.
• Use a trusted internal mirror or lockfile so deployments remain reproducible.
• Audit transitive dependencies and repeat verification whenever a pinned version is intentionally updated.
• Run installed skills with least privilege, separating build, test, and deployment credentials to limit the effect of a compromised package.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:42

Finding

Unvalidated User-Provided Prefix Is Interpolated into Bash Commands

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-53; additional affected commands at lines 164-166 and in README.md, lines 41-68
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

The Skill instructs the Agent to obtain a prefix from the user and later substitute it into Bash command positions without specifying validation, quoting, or argument-safe execution.

markdown

**Step 1:** Ask the user which role this agent should play and what prefix to use.

**Step 2:** Install the skills for the chosen role:
```bash
# For ci-builder:
clawhub install pilot-task-router pilot-share pilot-github-bridge
# For ci-tester:
clawhub install pilot-task-router pilot-share pilot-audit-log
# For ci-deployer:
clawhub install pilot-task-router pilot-share pilot-webhook-bridge pilot-receipt

Step 3: Set the hostname:

bash

pilotctl --json set-hostname <prefix>-<role>

text

The same unvalidated placeholder is used in handshake commands:

```bash
pilotctl --json handshake <prefix>-ci-tester "setup: ci-cd-pipeline"
pilotctl --json handshake <prefix>-ci-deployer "setup: ci-cd-pipeline"
pilotctl --json handshake <prefix>-ci-builder "setup: ci-cd-pipeline"

Technical Analysis

If the Agent performs textual substitution and executes the resulting command through Bash, shell metacharacters in the user-controlled prefix can terminate or alter the intended pilotctl command. For example, a prefix containing a command separator could cause Bash to interpret subsequent text as an additional command rather than as part of a hostname.

Quoting alone would reduce shell parsing risk but would not enforce valid hostname semantics. The robust solution is strict allowlist validation combined with direct argument-array execution that does not invoke a shell.

This finding is conditional on the Agent substituting the prefix verbatim into th ...[truncated 1136 chars]

Remediation

View remediation

Remediation Suggestions

• Validate the prefix before constructing any command. Use a strict hostname-compatible allowlist, such as lowercase ASCII letters, digits, and internal hyphens.
• Enforce appropriate length and label rules. A suitable policy is: ^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$
• Reject whitespace, quotes, semicolons, pipes, ampersands, redirection characters, backticks, dollar signs, parentheses, newlines, and all other characters outside the allowlist.
• Validate the selected role against an exact enumeration: ci-builder, ci-tester, or ci-deployer.
• Execute pilotctl using a direct process API and an argument array rather than generating a shell command string.
• If command examples remain in the documentation, show validated variables in double quotes while clearly stating that quoting does not replace validation.
• Display the normalized hostname and request user confirmation before changing the hostname or establishing trust relationships.
• Apply the same validation to every occurrence of the prefix in hostname, handshake, publish, and file-transfer commands.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file describes a deploy agent that deploys to production and triggers post-deploy webhooks, but it does not include any cautionary language about production impact, change control, or the risk of affecting live systems. Under the markdown-specific SQP-2 criteria, user-facing documentation should warn when behavior can affect system integrity.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The README states that mutual handshakes are auto-approved with no manual step, creating an automated trust-establishment path between agents. In a CI/CD context that moves build artifacts and can deploy to production, this weakens access control and could let a spoofed, compromised, or misidentified agent become trusted and participate in the pipeline.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# On ci-builder:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The README explains that GitHub webhooks trigger builds and that artifacts flow between agents over tunnels, but it does not warn users that repository contents, test reports, and deployment metadata may be transmitted across systems. For markdown files, SQP-2 applies when the description omits warnings about behaviors that could affect user data or privacy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.