Pilot Document Processing Setup

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:56 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a disclosed setup guide for a multi-agent document-processing pipeline, but users should treat its document sharing, persistence, external notifications, and dependency installs carefully.

Before installing or running this skill, confirm the exact ClawHub packages and publishers, use only a simple hostname-safe prefix, review every peer and downstream webhook destination, and avoid sending regulated or confidential documents unless the connected agents, storage, and retention practices are approved.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

-ingester # On server 2 (data extraction) clawhub install pilot-task-router pilot-dataset pilot-receipt pilotctl set-hostname -extractor # On server 3 (search indexing) clawhub install pilot-webhook-bridge pilot-announce pilot-metrics pilotctl set-hostname -indexer ``` ### Technical Analysis The setup installs nine external ClawHub skills by mutable package name. It does not specify exact versions, integrity hashes, trusted publisher identities, registry configuration, or a dependency lock file. The installed dependencies are not included in the audited project, so their implementation and transitive dependencies cannot be verified from the available source. If a named package or its publisher account is compromised, or if dependency resolution uses an unsafe source, the package retrieved during deployment could differ from the package originally reviewed. Because the project permits Bash usage and these skills participate in document ingestion, extraction, storage, publishing, and webhook operations, a compromised dependency could execute with the permissions assigned to the corresponding agent. ### Attack Path 1. An attacker compromises the publisher account, registry entry, or distribution channel for one of the named skills. 2. The attacker publishes ...[truncated 1261 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:53

Finding

Unvalidated Prefix Interpolation Can Cause Shell Command Injection

Content

View full analysis

- ``` The handshake commands repeat the same pattern: ```bash # ingester <-> extractor: pilotctl --json handshake -extractor "setup: document-processing" pilotctl --json handshake -ingester "setup: document-processing" # extractor <-> indexer: pilotctl --json handshake -indexer "setup: document-processing" pilotctl --json handshake -extractor "setup: document-processing" ``` Related README examples include: ```bash pilotctl set-hostname -ingester pilotctl set-hostname -extractor pilotctl set-hostname -indexer ``` ### Technical Analysis The Skill explicitly instructs the agent to ask the user for a deployment prefix. That prefix is subsequently interpolated into shell commands. The instructions do not constrain the prefix to a safe hostname character set and do not require the generated argument to be shell-quoted. If an agent implements these templates through direct textual replacement, a prefix containing shell metacharacters, command substitutions, whitespace, redirection operators, or control operators could alter the resulting Bash command. Quoting alone is insufficient if commands are first assembled and then passed through `eval` or `bash -c`; input validation and structured argument passing are both required. For example, a malicious value shaped like `safe; attacker-command; #` could transform a generated hostname command into multiple shell commands when su ...[truncated 1791 chars]

Remediation

View remediation

&2 exit 1 fi ``` 2. Reject whitespace, shell metacharacters, command substitutions, path separators, leading hyphens, and values exceeding hostname length limits. 3. Pass the resulting hostname as a quoted argument: ```bash hostname="${prefix}-${role}" pilotctl --json set-hostname "$hostname" pilotctl --json handshake "${prefix}-extractor" "setup: document-processing" ``` 4. Do not use `eval`, interpolate the value into `bash -c`, or construct a command as one executable string. 5. Where an API is available, invoke commands through an argument-array interface rather than through a shell. 6. Display the validated hostname and exact intended action to the user before changing persistent configuration or establishing trust. 7. Apply the same validation and quoting requirements consistently to hostname, handshake, subscribe, and publish examples in both `SKILL.md` and `README.md`. 8. Add tests covering malicious prefixes containing semicolons, spaces, backticks, `$()`, redirects, newlines, and option-like values. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README promotes a pipeline for ingesting and extracting data from documents without warning that documents may contain sensitive or regulated information. In this context, users may deploy the workflow on real invoices, receipts, contracts, or IDs and inadvertently expose sensitive data through extraction, indexing, or retention.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The data-flow section describes sending extracted data and notifications to indexers and external/downstream systems without any warning about data disclosure boundaries. Because this skill is specifically designed to move structured document content across agents and out to external systems, the omission increases the risk of unintentional exfiltration or oversharing.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Automatically approving trust once both sides exchange handshakes removes a human verification step from establishing inter-agent communication. In a multi-agent document-processing pipeline handling potentially sensitive data, this can lead to mistaken or unauthorized trust relationships that permit data access, forwarding, or exfiltration between the wrong agents.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# On ingester:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill directs the agent to create a persistent file under ~/.pilot/setups/document-processing.json, which changes future agent state outside the immediate session. Persistent configuration is security-relevant because it can silently influence later behavior, establish durable peer relationships, and outlive the user's current intent if not clearly disclosed and approved.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/document-processing.json << 'MANIFEST'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to persist a setup manifest locally and configure a pipeline that transmits documents and extracted data to other agents and external downstream systems, but it does not require any explicit user warning or consent about privacy, retention, or data sharing. In a document-processing context, the handled content may include sensitive business or personal data, so silent storage and onward transmission materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README describes the indexer role as publishing notifications to downstream systems and the data flow shows indexer --> external on port 443. However, the try-it example uses pilotctl publish <your-prefix>-indexer index-notification ..., which targets the indexer itself rather than an external downstream recipient, contradicting the documented intent of that step.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.