ClawHub
Back to skill

Security audit

Pilot Content Marketing Pipeline Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill’s content-marketing purpose is coherent, but its setup instructions give agents broad local and publishing authority with under-scoped safety controls.

Review before installing. Use only a simple alphanumeric deployment prefix, verify every peer identity before handshakes, pin or inspect the dependent skills, and use least-privilege CMS/Slack credentials in a staging environment before enabling production publication.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:45
Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content
View full analysis
-researcher # On server 2 (content writer) clawhub install pilot-task-router pilot-share pilot-receipt pilotctl set-hostname -writer # On server 3 (content publisher) clawhub install pilot-webhook-bridge pilot-announce pilot-slack-bridge pilotctl set-hostname -publisher ``` ### Technical Analysis The setup installs nine third-party skills using mutable package names. It does not specify immutable versions, integrity hashes, trusted publisher identities, or a required source registry. The contents of these dependencies are not included in the audited project and therefore cannot be verified as part of this audit. Resolving dependencies solely by package name makes the resulting installation dependent on the registry state at execution time. A package takeover, compromised publisher account, malicious replacement release, dependency-confusion condition, or unexpected upstream update could cause users to install behavior different from what was originally reviewed. The publisher role is particularly sensitive because its dependencies are intended to communicate with CMS and Slack endpoints. The other roles process research material and draft content. Consequently, a compromised dependency could potentially access data and capabilities availa ...[truncated 1537 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:40
Finding

Unvalidated Prefix Substitution Can Cause Shell Command Injection

Content
View full analysis
- ``` It is reused in handshake commands: ```bash # researcher and writer handshake with each other: pilotctl --json handshake -writer "setup: content-marketing-pipeline" pilotctl --json handshake -researcher "setup: content-marketing-pipeline" # writer and publisher handshake with each other: pilotctl --json handshake -publisher "setup: content-marketing-pipeline" pilotctl --json handshake -writer "setup: content-marketing-pipeline" ``` It is also reused in subscription and publication commands: ```bash # On writer -- subscribe to research briefs: pilotctl --json subscribe -researcher research-brief # On publisher -- subscribe to draft content: pilotctl --json subscribe -writer draft-content # On researcher -- publish a research brief: pilotctl --json publish -writer research-brief '{"topic":"AI Agent Frameworks","keywords":["agents","orchestration"],"sources":["arxiv:2406.01234"]}' # On writer -- publish draft to publisher: pilotctl --json publish -publisher draft-content '{"title":"The Rise of AI Agents","slug":"ai-agents-2026","word_count":1850,"format":"markdown"}' ``` ### Technical Analysis The deployment prefix originates from the user, but the instructions do not define or enforce a safe hostname grammar. The placeholder is inserted directly into Bash command examples without shell quoting. If an automated agent implemen ...[truncated 2332 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly promotes automated CMS publication and Slack/webhook notifications but does not warn that content and metadata may be sent to external systems with minimal human review. In a multi-agent content pipeline, this increases the risk of unintended data disclosure, accidental publication of unreviewed material, or propagation of prompt-injected/manipulated output to third-party services.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash
# researcher <-> writer

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation states that trust is automatically approved once both sides exchange handshakes, without explaining the security implications or verification requirements. This can normalize insecure trust establishment, allowing users to connect the wrong peer or trust a spoofed/misconfigured agent, which may then receive sensitive content or inject malicious downstream actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
97% confidence
Finding

This step establishes session persistence by storing configuration in a durable file under the user's home directory. Persistent state can influence later runs, survive beyond the user's immediate intent, and become a foothold for configuration drift or unintended automation if the manifest is modified or later trusted by the surrounding system.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/content-marketing-pipeline.json << 'MANIFEST'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs the agent to create and overwrite a persistent manifest in the user's home directory without an explicit warning, confirmation step, or discussion of side effects. Even though the target path appears application-specific, writing to ~/.pilot/setups changes local state across sessions and can unexpectedly alter future agent behavior or leak setup metadata if the file is later consumed by other tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill describes sending publication notifications to external systems such as a CMS and Slack via webhook without a privacy or network-action warning. This can cause unintended outbound data transfer, disclosure of content metadata, and interaction with third-party services if an agent follows the workflow automatically or a user does not realize external communication is involved.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.