Pilot Dropbox

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:40 AM UTC
• Version: 1.0.0

Overview

This shared-folder skill is coherent in purpose, but its example daemon trusts peer-provided filenames in ways that can delete or disclose files outside the shared folder.

Review this skill carefully before installing or using it as written. Only run it with trusted peers and topics, restrict it to a dedicated low-privilege account or sandbox, and add strict basename validation, canonical path containment checks, peer authorization, and confirmation or quarantine for deletes before using the daemon.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:94

Finding

Peer-Controlled Path Traversal Enables Arbitrary File Deletion

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 94–98
Vulnerability Type: Path traversal leading to arbitrary file deletion
Risk Level: High

bash

  file_removed)
    FILENAME=$(echo "$event" | jq -r '.filename')
    rm -f "$DROPBOX_DIR/$FILENAME"
    ;;

Technical Analysis

The filename value is extracted from a remotely received pub/sub event and appended directly to DROPBOX_DIR. Although the resulting shell argument is quoted, quoting only prevents shell word splitting and wildcard expansion; it does not prevent filesystem path traversal.

A malicious peer can provide a filename containing parent-directory components, such as ../../.ssh/authorized_keys. The resulting path may resolve outside the intended shared directory:

text

$HOME/pilot-dropbox/../../.ssh/authorized_keys

The implementation does not reject absolute paths, directory separators, .. components, or filenames that resolve outside the canonical shared-folder path. It also does not demonstrate authentication or authorization checks that restrict which publishers may issue deletion events.

Attack Path

1. The victim starts the documented shared-folder daemon and subscribes to a topic through pilotctl.
2. An attacker who can publish events to that topic sends a file_removed event.
3. The attacker sets the event's filename field to a traversal path such as ../../target-file.
4. The daemon concatenates that value with DROPBOX_DIR without validating the resolved path.
5. rm -f deletes the selected file if it is writable by the daemon's operating-system account.

Impact Assessment

A malicious peer may delete files outside the synchronized folder. The accessible scope is limited to files writable by the user account running the daemon, but may include user configuration, SSH authorization data, application state, Agent data, and other important files.

Successful exploitation can cause ...[truncated 191 chars]

Remediation

View remediation

Remediation Suggestions

• Treat every filename received from a peer as untrusted.
• Reject empty names, absolute paths, . and .. components, directory separators, and any value that differs from its basename.
• Canonicalize both the shared-folder root and candidate path, then verify that the candidate remains strictly beneath the canonical shared-folder root before deletion.
• Perform validation immediately before the filesystem operation to minimize validation/use inconsistencies.
• Maintain an allowlist or synchronization manifest of files that remote peers are permitted to delete.
• Authenticate event publishers and authorize deletion operations on a per-peer and per-folder basis.
• Consider moving deleted files to a controlled quarantine or trash directory rather than permanently deleting them immediately.
• Record the authenticated peer identity, validated path, and deletion result in an audit log.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:101

Finding

Peer-Controlled Path Traversal Enables Disclosure of Local Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 101–104
Vulnerability Type: Path traversal leading to unauthorized local file disclosure
Risk Level: High

bash

  dropbox_pull)
    FILENAME=$(echo "$event" | jq -r '.filename')
    pilotctl --json send-file "$FROM" "$DROPBOX_DIR/$FILENAME"
    ;;

Technical Analysis

The workflow takes the filename field from a remotely supplied event and uses it as part of the local path passed to pilotctl send-file. No validation or canonical containment check is performed.

A malicious peer can request a path such as ../../.ssh/id_rsa. Appending this value to DROPBOX_DIR does not confine access to that directory because the operating system resolves the parent-directory components before opening the file.

The transfer destination is also derived from the event's from data earlier in the workflow. The documented implementation does not show a mechanism that binds this value to an authenticated transport identity or verifies that the peer is authorized to retrieve the requested file.

Attack Path

1. The victim runs the shared-folder daemon under a user account with access to local files.
2. An attacker capable of sending an event to the subscribed channel submits a dropbox_pull event.
3. The attacker supplies a traversal value such as ../../.ssh/id_rsa in the filename field.
4. The daemon constructs a path that resolves outside DROPBOX_DIR.
5. pilotctl send-file reads the selected file under the daemon user's privileges.
6. The file is transmitted to the peer identified by the event processing logic.

Impact Assessment

The attacker may obtain any file that is readable by the account running the daemon and accepted by pilotctl send-file. Potentially exposed data includes private keys, credentials, tokens, configuration files, source code, user documents, application state, and Agent-related data.

The vulnerability provi ...[truncated 202 chars]

Remediation

View remediation

Remediation Suggestions

• Reject absolute paths, parent-directory components, path separators, empty values, and filenames that are not simple basenames.
• Resolve the requested file to a canonical path and verify that it remains beneath the canonical DROPBOX_DIR before invoking send-file.
• Only permit transfers of files recorded in an authenticated synchronization manifest; do not allow peers to request arbitrary local paths.
• Derive the recipient identity from authenticated protocol metadata rather than trusting a payload-controlled identity field.
• Enforce per-peer authorization for file retrieval and topic membership.
• Run the synchronization daemon under a dedicated least-privileged operating-system account with access only to the shared directory.
• Log denied traversal attempts and apply rate limits or peer blocking after repeated invalid requests.
• Use safe JSON construction, such as jq -n --arg, for generated protocol messages to prevent filenames from corrupting message structure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

Remove file from folder

bash

rm "$DROPBOX_DIR/$FILENAME"
pilotctl --json publish "$PEER" "$TOPIC" \
  --data "{\"type\":\"file_removed\",\"filename\":\"$FILENAME\"}"

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file_removed handler reads filename from an untrusted event and executes rm -f "$DROPBOX_DIR/$FILENAME" without path validation. An attacker controlling pub/sub messages can supply traversal sequences such as ../../../important.txt, causing deletion of arbitrary files reachable from the agent's permissions rather than only files inside the synchronized folder.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This command is executed in the remote event handler, so the FILENAME parameter comes directly from untrusted peer-controlled input. That makes the tool invocation an actual parameter-abuse vulnerability: a crafted filename can alter the target path and delete arbitrary files accessible to the process.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

file_removed)
      FILENAME=$(echo "$event" | jq -r '.filename')
      rm -f "$DROPBOX_DIR/$FILENAME"
      ;;

    dropbox_pull)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The daemon handles an incoming dropbox_pull event by taking an untrusted filename from the message and directly calling pilotctl --json send-file "$FROM" "$DROPBOX_DIR/$FILENAME". Because FILENAME is not validated or canonicalized, a peer can request paths like ../../.ssh/id_rsa and exfiltrate arbitrary local files outside the shared folder if they exist relative to DROPBOX_DIR.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown instructs users to remove a file with rm and publish a file_removed event, which can propagate deletion behavior across peers. The document does not include any warning that this operation deletes local data and may cause synchronized removal effects for shared-folder participants.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The daemon example automates processing of remote events, including deleting local files and sending files back to peers, but the documentation does not warn that these actions are security-sensitive and trust remote input. In the context of a synchronization skill exposed to multi-peer pub/sub, omission of safety guidance materially increases the chance that users deploy dangerous code as-is.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.