Pilot Customer Support Triage Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:00 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate support-triage setup guide, but it needs review because it configures agent trust, unpinned skills, and external customer-data forwarding without enough safeguards.

Review this before installing in a real support environment. Use only approved and pinned skill versions, validate the deployment prefix against a strict hostname-safe pattern, verify peer identities before handshakes, and restrict Slack/webhook forwarding to approved destinations with only the minimum redacted ticket fields needed for escalation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51

Finding

Unpinned Third-Party Skill Installation

Content

View full analysis

-triage-bot # On server 2 (auto-resolver) clawhub install pilot-task-router pilot-receipt pilot-audit-log pilotctl set-hostname -resolver # On server 3 (escalation agent) clawhub install pilot-webhook-bridge pilot-slack-bridge pilot-alert pilotctl set-hostname -escalator ``` ### Technical Analysis The setup procedure installs nine registry-hosted skills without specifying immutable versions, content hashes, signatures, or trusted publisher identities. Consequently, the code installed during deployment is not necessarily the same code that existed when this project was audited. This risk is particularly significant for `pilot-webhook-bridge` and `pilot-slack-bridge`, which are intended to process support-ticket data and communicate with external systems. A compromised or unexpectedly updated dependency could inherit access to ticket content, customer information, local files available to the agent, and configured outbound communication channels. The project does not itself contain a malicious dependency or embedded payload. The vulnerability is the lack of controls ensuring that future dependency resolution retrieves reviewed and trusted artifacts. ### Attack Path 1. An attacker compromises the publish ...[truncated 1501 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:47

Finding

Shell Command Injection Through an Unvalidated Deployment Prefix

Content

View full analysis

- ``` Additional affected commands include: ```bash # triage-bot handshakes with resolver and escalator: pilotctl --json handshake -resolver "setup: customer-support-triage" pilotctl --json handshake -escalator "setup: customer-support-triage" # resolver and escalator handshake back with triage-bot: pilotctl --json handshake -triage-bot "setup: customer-support-triage" pilotctl --json handshake -triage-bot "setup: customer-support-triage" ``` ```bash # On resolver -- subscribe to routine tickets: pilotctl --json subscribe -triage-bot ticket-routine # On escalator -- subscribe to complex tickets: pilotctl --json subscribe -triage-bot ticket-complex # On triage-bot -- route a routine ticket: pilotctl --json publish -resolver ticket-routine '{"ticket_id":"TK-4821","category":"account","urgency":"low","subject":"Password reset"}' # On triage-bot -- route a complex ticket: pilotctl --json publish -escalator ticket-complex '{"ticket_id":"TK-4822","category":"technical","urgency":"critical","subject":"Data loss in production"}' ``` ### Technical Analysis The deployment prefix is user-controlled, but the instructions do not require validation against a hostname-safe allowlist before inserting it into Bash commands. If an agent performs textual substitution and executes the resulting command through a shell, shell metachara ...[truncated 2580 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly states that complex support cases are enriched with customer history and account context, then forwarded to external helpdesk and Slack destinations, but it does not warn about privacy, data minimization, or consent requirements. In a customer support workflow, this creates a realistic risk of unnecessary disclosure of customer data to third-party systems and broad internal channels.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The trust model auto-approves communication once both sides send a handshake, with no documented manual verification of peer identity, authorization scope, or out-of-band approval. In a multi-agent deployment that routes customer support data, this can lead to overly permissive trust establishment and accidental linkage to misnamed, unauthorized, or attacker-controlled agents if operators follow the setup naively.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# triage-bot <-> resolver

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The example publish commands include identifiable customer email addresses, incident details about production data loss, enterprise account status, and a helpdesk URL, all without any warning about sensitive-data handling. Because README examples are often copied directly, this normalizes propagation of potentially sensitive customer and incident information across agents and external channels.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/customer-support-triage.json << 'MANIFEST'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly routes complex support tickets to external webhook and Slack destinations but does not instruct the operator to review, minimize, redact, or obtain approval before transmitting potentially sensitive customer data. In a customer-support context, tickets commonly contain PII, account details, and incident context, so silent exfiltration to third-party systems creates a real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.