Pilot E Commerce Ops Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:00 AM UTC
• Version: 1.0.0

Overview

This setup skill is coherent, but needs Review because it can install many unpinned add-ons, persist agent configuration, create trusted agent links, and route customer support data externally without enough safeguards.

Install only in a controlled test or reviewed production environment. Pin and verify the dependent skills, validate the deployment prefix, review the exact ~/.pilot setup file before writing it, verify peer identities before handshakes, and configure any support webhook with authentication, TLS, data minimization, and retention controls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:58

Finding

Unquoted User-Controlled Prefix Can Enable Shell Command Injection

Content

View full analysis

- ``` ``` The same unsafe interpolation pattern is repeated in handshake and workflow commands at `SKILL.md:146-160` and `SKILL.md:166-173`, and in setup and operational examples throughout `README.md:43-117`. ### Technical Analysis The skill directs the agent to ask the user for a deployment prefix and then substitute that value into Bash commands. The prefix is not validated against a hostname-safe character set, and the resulting argument is not quoted. If the agent directly interpolates a supplied prefix into the command template and runs it through a shell, shell metacharacters, command substitutions, whitespace, or redirection operators in the prefix can be interpreted as shell syntax rather than as part of a hostname. Quoting alone would prevent shell parsing of most metacharacters, but strict validation is also necessary because the value is intended to become a hostname and peer identifier. For example, directly replacing `` with a value containing a command separator could transform the intended single command into multiple shell commands. This issue affects hostname assignment as well as the repeated handshake, subscribe, and publish templates. ### Attack Path 1. The setup process asks a user or another untrusted source to provide a deployment prefix. 2. An attacker supplies a prefix containing shell syntax, such as a command separator followed by an attacker-selected command. 3. The agent replaces `` in the documented Bash template without validation or shell-safe argument handling. 4. The agent invokes the interpolated command through Bash, as authorized by the skill's `allowed-tools` configuration. 5. The shell interprets the injected sy ...[truncated 945 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README describes customer support data flows and explicitly routes support escalations to an external webhook, while example payloads later include customer identifiers such as an email address and tracking data. In an e-commerce context, this creates a real privacy and data-governance risk because operators may deploy cross-agent and external data sharing without notice, minimization, or controls around what customer data is sent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The trust model auto-approves a relationship once both sides send a handshake, with no manual verification or out-of-band identity validation. In a distributed multi-agent e-commerce deployment, this weakens onboarding security and can allow an attacker controlling a similarly named or compromised agent to establish trusted communication and receive or inject operational events affecting orders, inventory, or support.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# On catalog-manager:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The manifest write persists operational setup data in the user's home directory, creating session persistence beyond the current interaction. While persistence is expected for setup workflows, it is still a real risk because it can silently alter later agent behavior, survive session boundaries, and be reused by other tools or processes.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/e-commerce-ops.json << 'MANIFEST'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs writing a manifest into ~/.pilot/setups without any explicit warning that it will modify persistent local configuration. This creates a real safety issue because users may not realize the action changes future agent behavior and leaves durable state on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The support-bot role defines a data flow to an external webhook on port 443, but the skill provides no privacy, integrity, or destination-trust warning to the user. In an e-commerce context, support escalations may contain customer or order data, so silent external transmission increases the risk of unintended disclosure or exfiltration.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.