Pilot Digital Twin Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:27 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for setting up a digital twin system, but it asks users to install unpinned agent skills and enable high-impact agent communication without enough verification guidance.

Review this skill before installing in production. Pin and verify all dependent skills, confirm peer identities before handshakes, inspect the manifest written under ~/.pilot, and restrict external maintenance-order integrations to approved endpoints and credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:52

Finding

Unpinned Third-Party Skills Installed from a Mutable Registry

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52-60; the same installation pattern is also documented in README.md, lines 47-60
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

# For sensor-bridge:
clawhub install pilot-stream-data pilot-metrics pilot-gossip
# For model-engine:
clawhub install pilot-dataset pilot-task-router pilot-consensus
# For anomaly-detector:
clawhub install pilot-event-filter pilot-alert pilot-audit-log
# For action-planner:
clawhub install pilot-webhook-bridge pilot-cron pilot-slack-bridge

The corresponding commands in README.md are:

bash

# On sensor bridge node
clawhub install pilot-stream-data pilot-metrics pilot-gossip
pilotctl set-hostname <your-prefix>-sensor-bridge

# On model engine node
clawhub install pilot-dataset pilot-task-router pilot-consensus
pilotctl set-hostname <your-prefix>-model-engine

# On anomaly detector node
clawhub install pilot-event-filter pilot-alert pilot-audit-log
pilotctl set-hostname <your-prefix>-anomaly-detector

# On action planner node
clawhub install pilot-webhook-bridge pilot-cron pilot-slack-bridge
pilotctl set-hostname <your-prefix>-action-planner

Technical Analysis

The setup procedure installs twelve external skills using only mutable package names. It does not specify reviewed versions, immutable content digests, trusted publisher identities, cryptographic signatures, a dependency lockfile, or a verification step.

Consequently, the content installed at deployment time may differ from the content that was originally reviewed. This creates a supply-chain trust boundary around the external clawhub registry and the publisher accounts for all named packages. The source and implementation of these dependencies are not included in the audited project, so their safety cannot be established from the available files.

The affected dependencies are:

• pilot-stream-data
• `pilot-metric ...[truncated 2180 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to a reviewed, immutable version rather than installing by package name alone.
2. Prefer cryptographic content digests where supported, for example a package reference bound to a SHA-256 digest.
3. Record resolved versions and digests in a committed dependency lockfile.
4. Verify package signatures and publisher identities before installation.
5. Restrict installation to an explicitly approved registry and disable untrusted fallback sources or namespace resolution.
6. Download dependencies into a staging environment and review their Skill instructions, scripts, manifests, requested tools, and transitive dependencies before deployment.
7. Add an automated policy that rejects packages whose resolved digest differs from the approved lockfile.
8. Maintain an allowlist of approved package names, publishers, versions, and hashes.
9. Run installed skills with least privilege, isolated credentials, restricted filesystem access, and role-specific network egress controls.
10. Separate installation privileges from runtime privileges so a deployed agent cannot update or replace its own dependencies.
11. Monitor registry advisories and publisher changes, and require explicit review before updating any pinned dependency.
12. Update both SKILL.md and README.md so all installation examples use the same verified and immutable dependency references.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The skill instructs operators to rely on reciprocal handshakes that are automatically approved, removing any independent verification step before establishing trust between agents. In a multi-agent system that forwards telemetry, predictions, and maintenance actions, this increases the chance of an unintended or spoofed peer being trusted and then sending data or commands downstream.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# sensor-bridge <-> model-engine (telemetry)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

Writing the manifest to ~/.pilot/setups/digital-twin.json creates session-persistent configuration that can influence later behavior without being visible in the current interaction. In agent tooling, hidden or poorly disclosed persistence increases the risk of unintended reuse, stale configuration, or tampering by other local processes/users, especially if the manifest governs peer communications and external actions.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

clawhub install pilot-webhook-bridge pilot-cron pilot-slack-bridge

text

**Step 3:** Set the hostname and write the manifest to `~/.pilot/setups/digital-twin.json`.

**Step 4:** Tell the user to initiate handshakes with the peers for their role.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill defines data flows carrying operational telemetry, anomaly information, and outbound maintenance orders, including delivery to external systems, without an explicit privacy/integrity warning. In an industrial setting, this can expose sensitive asset data or trigger business-impacting actions if peers or external endpoints are misconfigured, untrusted, or compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to write a manifest under the user's home directory but does not warn the user that a persistent local file will be created. This is a real transparency and consent issue because it changes local state outside the immediate command context, though the file path and purpose are predictable and not inherently stealthy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.