Pilot Competitor Intelligence Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:00 AM UTC
• Version: 1.0.0

Overview

The skill appears to do what it says, but its setup changes the agent environment, installs many external skills, and writes persistent configuration without enough scoping or safety checks.

Review the companion skills before installing, pin trusted versions or digests where possible, use a simple alphanumeric deployment prefix, verify peer hostnames before handshakes, and confirm any existing ~/.pilot setup file before writing the manifest. Treat Slack and webhook outputs as external sharing of competitive-intelligence data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48

Finding

Unpinned Third-Party Skill Installation

Content

View full analysis

-crawler # On server 2 (market analyzer) clawhub install pilot-event-filter pilot-metrics pilot-task-router pilotctl set-hostname -analyzer # On server 3 (change tracker) clawhub install pilot-audit-log pilot-dataset pilot-alert pilotctl set-hostname -tracker # On server 4 (intelligence alerter) clawhub install pilot-slack-bridge pilot-webhook-bridge pilot-announce pilotctl set-hostname -alerter ``` ### Technical Analysis The setup installs twelve third-party Skills by mutable package name. It does not specify immutable versions, content digests, signatures, trusted publisher identities, or an approved registry source. The dependency implementations are not included in the audited project, so their behavior cannot be verified from the package contents reviewed here. Resolving packages only by name means that the code installed at setup time may differ from the code originally reviewed. Registry account compromise, a compromised release, package replacement, or unsafe dependency resolution could introduce malicious behavior without any change to this repository. This finding does not establish that the named packages are currently malicious. It identifies an unsafe supply-chain control that permits package content ...[truncated 1381 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:43

Finding

Unvalidated User-Controlled Prefix in Shell Commands and JSON Manifests

Content

View full analysis

- ``` ```bash mkdir -p ~/.pilot/setups cat > ~/.pilot/setups/competitor-intelligence.json << 'MANIFEST' MANIFEST ``` The manifest templates directly embed the same value. For example, `SKILL.md:76-85` contains: ```json { "setup": "competitor-intelligence", "setup_name": "Competitor Intelligence", "role": "crawler", "role_name": "Web Crawler", "hostname": "-crawler", "description": "Scrapes competitor websites, pricing pages, product launches, and press releases.", "skills": {"pilot-stream-data": "Stream crawled pages and pricing data to analyzer.", "pilot-archive": "Archive raw HTML snapshots for historical comparison.", "pilot-cron": "Schedule crawl jobs on configurable intervals."}, "peers": [{"role": "analyzer", "hostname": "-analyzer", "description": "Receives crawled data for analysis"}], "data_flows": [{"direction": "send", "peer": "-analyzer", "port": 1002, "topic": "crawled-data", "description": "Crawled data from competitor sites"}], "handshakes_needed": ["-analyzer"] } ``` The value is also embedded into handshake commands at `SKILL.md:150-159`: ```bash # crawler <-> analyzer: pilotctl --json handshake -analyzer "setup: competitor-intelligence" pilotctl --json handshake -crawler "setup: competitor-intelligence" # analyze ...[truncated 3584 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly routes intelligence reports to Slack and webhooks but provides no warning that potentially sensitive competitive intelligence will leave the local agent environment and be transmitted to third-party systems. In a multi-agent pipeline that aggregates competitor monitoring data, this omission can cause accidental disclosure of internal strategy signals, collected data, or regulated information through misconfigured external destinations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# On crawler:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The setup instructs operators to establish mutual trust between agents and states that trust is auto-approved with no manual verification step, but it does not warn about the consequences of trusting the wrong peer or using an attacker-controlled prefix/host. In this context, trust likely enables message exchange across the pipeline, so mistaken or spoofed trust establishment could permit unauthorized data injection, exfiltration, or alert manipulation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly routes collected intelligence to Slack, email, dashboards, and webhooks, but provides no warning about transmitting potentially sensitive business intelligence to third-party services. This can lead to unintended data disclosure, especially if crawled or analyzed content includes confidential notes, internal enrichments, or misclassified sensitive data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 79% confidence

Finding

The skill persists configuration by writing a manifest into ~/.pilot/setups, creating lasting state on disk that may affect future agent behavior. Without an explicit warning, overwrite check, or cleanup guidance, users may unknowingly leave persistent configuration behind or replace an existing setup file.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/competitor-intelligence.json << 'MANIFEST'

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file includes commands that create a directory and write ~/.pilot/setups/competitor-intelligence.json, which affects user data on disk. The surrounding instructions do not warn the user that the setup procedure will modify files in their home directory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.