ClawHub
Back to skill

Security audit

Pilot Code Review Pipeline Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill’s code-review pipeline purpose is coherent, but it installs multiple unpinned agent skills and sets up trusted agents and external reporting with under-specified controls.

Review this skill before installing in a real repository environment. Pin and verify the helper skills, restrict GitHub and Slack credentials to the minimum needed, validate deployment prefixes before running commands, verify peer identities before handshakes, and avoid sending sensitive findings or private repository details to broad channels or unapproved webhooks.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:45
Finding

Unpinned Third-Party Skill Dependencies

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:54
Finding

User-Controlled Deployment Prefix Used in Unquoted Shell Commands

Content
View full analysis
- ``` ``` The same unquoted substitution pattern is repeated in commands such as: ```bash pilotctl --json handshake -reviewer "setup: code-review-pipeline" pilotctl --json subscribe -scanner scan-result pilotctl --json publish -reviewer scan-result '{"pr":142,"repo":"acme/api","findings":[{"file":"auth.go","line":58,"severity":"high","rule":"sql-injection"}]}' ``` The setup instructions establish that the prefix originates from the user: ```markdown **Step 1:** Ask the user which role this agent should play and what prefix to use. ``` ### Technical Analysis The Skill instructs the agent to obtain a deployment prefix from the user and interpolate it into Bash commands without quoting or validating it. No hostname allowlist, length constraint, rejection of leading hyphens, or safe argument-construction requirement is defined. If the agent performs direct textual substitution before invoking Bash, shell metacharacters in a malicious prefix can be interpreted as command syntax. Even where the value is introduced through ordinary shell variable expansion and is not reinterpreted as shell syntax, unquoted whitespace and option-like input can still alter argument boundaries or `pilotctl` option parsing. The placeholder-based documentation is not itself an executable script, so exploitation depends on how the executing agent translates the instructions into a concrete command. Nevertheless, the prescribed command-construction pattern does not safely handle untrusted input. ### Attack Path 1. The setup agent ...[truncated 1397 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README instructs users to automatically post review results to PRs, Slack, and external systems, but it does not warn that scan findings, filenames, repository names, or other potentially sensitive metadata may be disclosed outside the immediate review context. In a code review pipeline, this can leak internal code structure, security findings, or private repo information to broader audiences or third-party services if integrations are misconfigured.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash
# On reviewer:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trust model is described as automatically approving trust once both sides exchange handshakes, but the documentation does not explain the security consequences of establishing that relationship. In this skill's context, trusted agents can exchange review data and trigger workflow actions, so users may create unintended trust links without verifying host identity, role, or environment separation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

The skill persists a setup manifest under ~/.pilot/setups, creating durable local state that includes hostnames, peer relationships, handshakes, and data-flow metadata. While this is normal operational behavior, the instructions do not mention retention, sensitivity, file permissions, or cleanup, so the persisted file could reveal internal topology or configuration to other local users or future processes.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/code-review-pipeline.json << 'MANIFEST'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly instructs the reporter role to send review data to external systems such as GitHub webhooks and Slack, but it does not require any user confirmation, data classification, or warning that PR contents, findings, or metadata may leave the local environment. In a code-review pipeline, this can expose sensitive code, vulnerability details, repository metadata, or internal comments to third-party services unintentionally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.