ClawHub
Back to skill

Security audit

Pilot Dev Team Assistants Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent PR-automation purpose, but it asks users to install multiple unpinned agent integrations and auto-connect trusted agents that can share PR data and post updates.

Use this only in a controlled development environment. Before installing, pin and review each dependency, verify agent identities before handshakes, restrict GitHub and Slack credentials to the minimum needed repos and channels, and review any existing ~/.pilot manifest before writing the new setup.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:38
Finding

Unpinned Installation of Third-Party Agent Skills

Content
View full analysis
-reviewer # On docs server clawhub install pilot-github-bridge pilot-share pilot-task-router pilotctl set-hostname -doc-writer # On test server clawhub install pilot-github-bridge pilot-task-router pilot-audit-log pilotctl set-hostname -test-runner # On coordinator server clawhub install pilot-github-bridge pilot-task-chain pilot-slack-bridge pilot-broadcast pilotctl set-hostname -coordinator ``` ### Technical Analysis The setup instructions install numerous third-party Agent Skills using mutable package names. They do not specify immutable versions or content digests, verify cryptographic signatures, validate publisher identities, or require review of the downloaded package contents. Consequently, the code ultimately installed and executed is not represented in this repository and may change after this Skill has been audited. If a named package or its distribution account is compromised, or if package resolution selects an attacker-controlled component, following these instructions could introduce malicious instructions or executable code into the four-agent deployment. The exposed capabilities vary by role and include GitHub integration, test execution, task routing, file sharing, Slack communication, ...[truncated 2051 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
92% confidence
Finding

The phrase 'trust is auto-approved -- no manual step needed' describes autonomous security-sensitive decision making: the system grants trust automatically once a protocol condition is met. In a multi-agent system that handles PR contents, test execution, documentation artifacts, and result aggregation, this can let unverified or misidentified agents become trusted and influence workflow outputs without human review.

Content

Scanner excerpt · README.md (reported line 66)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash
# On coordinator:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly states that mutual handshakes cause trust to be auto-approved with no manual verification step. That creates a risky trust-on-first-mutual-contact model where an operator may connect agents without validating identity, increasing the chance of unauthorized agent pairing, spoofed peers, or unintended data sharing across the PR workflow.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

clawhub install pilot-github-bridge pilot-task-chain pilot-slack-bridge pilot-broadcast

text

**Step 3:** Set hostname and write manifest to `~/.pilot/setups/dev-team-assistants.json`.

**Step 4:** Handshake with coordinator (all agents handshake the coordinator).

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill routes PR details, review findings, test results, generated docs, and Slack status updates across multiple agents and external systems without any warning about confidentiality, scope minimization, or approval for sharing. In a PR automation context, this can expose private code, branch names, repository metadata, or sensitive findings to unnecessary recipients or third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file instructs the operator to set a hostname and write a manifest to ~/.pilot/setups/dev-team-assistants.json, which changes local user configuration. The skill description does not include any caution that it will create or overwrite a file in the user's home directory or advise reviewing the manifest before writing it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.