ClawHub
Back to skill

Security audit

Pilot Cloud Cost Optimizer Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent cloud-cost setup guide, but it enables high-impact agent behavior without enough safeguards around cloud changes, outbound reporting, trust setup, and dependency installation.

Review this before installing in any real cloud environment. Use a safe prefix containing only simple hostname characters, pin and verify every dependent skill, limit each role's cloud credentials, require human approval before shutdown, terminate, or rightsizing actions, and restrict reporter destinations to approved Slack, email, or webhook targets.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:47
Finding

Unpinned Third-Party Skill Installation Creates Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:44
Finding

Unvalidated Prefix Interpolation Can Enable Shell Command Injection

Content
View full analysis
- ``` ``` Related handshake templates also interpolate the prefix without shell quoting: ```bash pilotctl --json handshake -analyzer "setup: cloud-cost-optimizer" pilotctl --json handshake -scanner "setup: cloud-cost-optimizer" ``` ### Technical Analysis The skill explicitly obtains a deployment prefix from the user and instructs a Bash-capable agent to substitute it into shell command templates. The resulting hostname and handshake arguments are not quoted, and the documented procedure does not validate the prefix before command construction. If an agent performs literal string substitution and then executes the result through a shell, metacharacters in an attacker-controlled prefix—such as semicolons, command substitutions, pipes, redirections, or shell operators—can be interpreted as shell syntax rather than as part of a hostname. For example, a malicious prefix conceptually shaped like `safe; attacker-command #` could transform the generated command into multiple shell operations. Exploitability depends on the executing agent substituting the input into the template and invoking it thro ...[truncated 1917 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README describes an optimizer that can shut down or terminate resources as part of cost savings, but it does not clearly warn operators about service disruption, data loss, or the need for explicit approval gates. In a FinOps automation skill, destructive actions are especially sensitive because users may treat the setup guide as production-ready and enable actions that affect live workloads.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
92% confidence
Finding

The trust model auto-approves communication once both sides send a handshake, with no manual verification step or authenticated out-of-band approval described. In a multi-agent system that can trigger optimization actions, this increases the risk of unauthorized pairing, spoofed peers, or accidental trust establishment that could lead to command injection into downstream agents.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash
# scanner <-> analyzer (resource metrics flow)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The optimizer role is described as executing approved optimizations, but the skill description does not prominently warn that such actions can change or terminate infrastructure resources. In a cloud-cost context, optimization actions may be operationally destructive if recommendations are wrong, approvals are weak, or downstream skills automate execution too broadly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The reporter role is designed to transmit cost reports to external systems via Slack, email, or webhooks, but the skill description does not clearly warn users about this outbound data flow. That omission can cause unintentional exfiltration of potentially sensitive billing, resource, and savings data to third-party destinations if a user enables the reporter without understanding its network behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

clawhub install pilot-webhook-bridge pilot-slack-bridge pilot-announce

text

**Step 3:** Set the hostname and write the manifest:
```bash
pilotctl --json set-hostname <prefix>-<role>
mkdir -p ~/.pilot/setups

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The reporter is described as sending cost summaries and savings reports to Slack and email without warning that these channels may expose billing, resource inventory, anomaly, or optimization data to third parties or broad internal audiences. While not inherently unsafe, omitting a privacy and data-handling warning can lead to unintended disclosure of sensitive operational and financial information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file instructs the user to run commands that create ~/.pilot/setups and write a role-specific manifest, and also to set the hostname. Those actions modify local system state, but the skill description does not include a clear warning or disclosure about these changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.