Pilot Compliance Governance Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:56 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate compliance setup skill, but it needs review because it installs many unpinned skills, creates persistent local governance state and trust links, and can route compliance data to Slack or webhooks.

Review before installing in a real compliance environment. Pin and verify every dependency, isolate each role, confirm peer identities before handshakes, restrict outbound Slack and webhook destinations, inspect the manifest before writing it, and document how to rotate keys and remove the persistent setup state.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Unpinned Third-Party Skill Dependencies Installed from a Mutable Registry

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:47-55; duplicated in README.md:45-60
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The setup procedure installs 15 third-party skills by mutable package name without specifying immutable versions, cryptographic digests, publisher signatures, or an explicitly trusted registry.

Vulnerable code in SKILL.md:47-55:

bash

# policy-engine:
clawhub install pilot-event-filter pilot-sla pilot-workflow pilot-task-chain
# auditor:
clawhub install pilot-audit-log pilot-verify pilot-event-log pilot-cron
# certifier:
clawhub install pilot-certificate pilot-keychain pilot-verify pilot-receipt
# reporter:
clawhub install pilot-metrics pilot-webhook-bridge pilot-slack-bridge pilot-archive

Equivalent installation instructions in README.md:45-60:

bash

# On policy engine node
clawhub install pilot-event-filter pilot-sla pilot-workflow pilot-task-chain
pilotctl set-hostname <your-prefix>-policy

# On auditor node
clawhub install pilot-audit-log pilot-verify pilot-event-log pilot-cron
pilotctl set-hostname <your-prefix>-auditor

# On certifier node
clawhub install pilot-certificate pilot-keychain pilot-verify pilot-receipt
pilotctl set-hostname <your-prefix>-certifier

# On reporter node
clawhub install pilot-metrics pilot-webhook-bridge pilot-slack-bridge pilot-archive
pilotctl set-hostname <your-prefix>-reporter

Technical Analysis

Resolving dependencies solely by package name makes installation behavior dependent on the current state of the external ClawHub registry. The audited project does not constrain the selected package versions or provide hashes, signatures, a lock file, or another mechanism that binds each dependency to reviewed content.

This creates a supply-chain exposure: if a publisher account, registry, distribution path, or named package is compromised or repla ...[truncated 2318 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every skill to an immutable, reviewed version rather than installing by package name alone.
2. Prefer content-addressed digests and verify cryptographic hashes before installation.
3. Require publisher signatures and validate them against an organization-controlled allowlist of trusted signing identities.
4. Use a trusted internal registry or mirror containing only reviewed artifacts.
5. Maintain a lock file or signed dependency manifest recording exact versions, digests, publishers, and review dates.
6. Audit each transitive skill dependency before deployment, especially components handling keys, cron-like scheduling, webhooks, Slack, and archives.
7. Apply least privilege per role. Restrict filesystem access, secrets, tools, and outbound network destinations to those strictly required.
8. Isolate the four roles in separate service accounts or containers and prevent an installed skill from accessing another role's data directly.
9. Require explicit operator approval before dependency upgrades, followed by repeatable security review and integrity verification.
10. Add automated CI checks that reject unpinned clawhub install commands and fail when recorded digests or signatures do not match.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

md

pilotctl set-hostname <your-prefix>-auditor

# On certifier node
clawhub install pilot-certificate pilot-keychain pilot-verify pilot-receipt
pilotctl set-hostname <your-prefix>-certifier

# On reporter node

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

pilotctl set-hostname <your-prefix>-auditor

# On certifier node
clawhub install pilot-certificate pilot-keychain pilot-verify pilot-receipt
pilotctl set-hostname <your-prefix>-certifier

# On reporter node

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

pilotctl set-hostname <your-prefix>-auditor

# On certifier node
clawhub install pilot-certificate pilot-keychain pilot-verify pilot-receipt
pilotctl set-hostname <your-prefix>-certifier

# On reporter node

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The README explicitly states that mutual handshakes cause trust to be auto-approved with no manual review. In a compliance/governance system, this weakens identity assurance and allows an attacker who can trigger or impersonate reciprocal handshakes to become trusted, enabling unauthorized message exchange between sensitive agents such as the certifier and auditor.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# policy <-> auditor

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Writing a manifest into ~/.pilot/setups creates persistent local state that can influence future sessions or be consumed by other tooling, yet the skill does not describe lifecycle, permissions, or cleanup. Persistence without transparency can enable unintended reuse of hostnames, peers, and data-flow configuration across later runs, which is risky in a multi-agent governance setup.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

clawhub install pilot-metrics pilot-webhook-bridge pilot-slack-bridge pilot-archive

text

**Step 3:** Set hostname and write manifest to `~/.pilot/setups/compliance-governance.json`.

**Step 4:** Handshake: policy↔auditor, policy↔certifier, auditor↔reporter, certifier↔reporter.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The reporter role is configured to forward compliance reports to external systems and Slack, but the skill provides no privacy or integrity warning about transmitting potentially sensitive audit findings and certification records off-host. Compliance data often contains operational or regulated information, so silent forwarding increases risk of data leakage and unauthorized disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs writing a manifest into the user's home directory but does not warn the user that local configuration will be created or persisted there. This can surprise users, leave stale governance state on disk, and affect later agent behavior if the manifest is reused implicitly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.