ClawHub
Back to skill

Security audit

Pilot Customer Onboarding Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill has a plausible onboarding purpose, but it asks agents to run broad shell setup commands, install unpinned skills, persist trust/configuration, and send customer data externally without enough safeguards.

Review this skill before installing in a real customer environment. Pin and verify every dependency, restrict prefixes to safe hostname characters, confirm peer identities before handshakes, and only send minimized customer data to approved Slack/webhook destinations with appropriate consent and retention controls.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:52
Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content
View full analysis
-welcome-bot # On server 2 (setup guide) clawhub install pilot-task-chain pilot-share pilot-webhook-bridge pilotctl set-hostname -setup-guide # On server 3 (success tracker) clawhub install pilot-metrics pilot-alert pilot-slack-bridge pilotctl set-hostname -success-tracker ``` ### Technical Analysis The setup procedure installs nine remotely sourced Skills without specifying immutable versions, cryptographic hashes, commit references, signatures, or publisher-verification requirements. Consequently, installation resolves whatever package version the configured registry serves at execution time. The installed dependencies are not included in this project, so their implementation and effective behavior cannot be verified by auditing the two files in this repository. A legitimate dependency could also become malicious after this project has been reviewed. This creates a supply-chain exposure involving: - Compromise of a dependency publisher or registry account. - Malicious updates to an otherwise legitimate package. - Dependency-name takeover or registry substitution. - Installation from an unexpected or compromised registry. - Behavioral changes between deployments because versions are not pinned. ### Attack Path 1. An attacker compromises the publisher account, distribution channel, or registry entry ...[truncated 1364 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:49
Finding

Unvalidated User-Controlled Prefix Is Interpolated into Shell Commands

Content
View full analysis
- ``` The same prefix is also interpolated without shell quoting in handshake commands: ```bash # welcome-bot <-> setup-guide: pilotctl --json handshake -setup-guide "setup: customer-onboarding" pilotctl --json handshake -welcome-bot "setup: customer-onboarding" # setup-guide <-> success-tracker: pilotctl --json handshake -success-tracker "setup: customer-onboarding" pilotctl --json handshake -setup-guide "setup: customer-onboarding" ``` The README repeats the unsafe command pattern: ```bash pilotctl set-hostname -welcome-bot pilotctl handshake -setup-guide "setup: customer-onboarding" ``` ### Technical Analysis The `prefix` originates from user input, but the instructions provide no validation, length restriction, character allowlist, or safe shell-escaping requirement. The selected role is also user-supplied in Step 1, although the document expects one of three predefined role names. If an agent performs direct textual substitution and then executes the resulting Bash command, shell metacharacters in the prefix can alter command structure. Characters and constructs such as semicolons, command substitutions, redirections, pipelines, or logical operators could cause Bash to execute operations beyond the intended `pilotctl` invocation. For example, a malicious prefix conceptually shaped like: ```text acme; id # ``` could pr ...[truncated 1850 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README explicitly describes sending customer profiles, onboarding progress, and health reports between agents and to external systems, but it provides no warning about handling personal data, consent, retention, minimization, or secure transport expectations. In a customer onboarding context, these payloads include identifiable and potentially sensitive business data, so normalizing this flow without privacy guidance increases the risk of inappropriate sharing or noncompliant deployment.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The trust model states that when both sides send a handshake, trust is automatically approved with no manual review. That reduces human verification for inter-agent trust establishment and can allow unintended or misdirected trust relationships if an operator targets the wrong hostname, a naming collision occurs, or an unauthorized but reachable agent participates in the exchange.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash
# welcome-bot <-> setup-guide

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/customer-onboarding.json << 'MANIFEST'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly routes customer onboarding progress and health-report data to external systems and Slack/webhooks, but it provides no privacy warning, consent guidance, data-classification limits, or minimization requirements. In this context, the omission is security-relevant because operators may deploy flows that transmit customer identifiers, preferences, and health/risk signals to third parties without realizing the privacy and compliance implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.