Pilot Energy Grid Optimizer Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:08 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for energy-grid setup, but it reaches physical device-control workflows without enough scoping, safety gates, or dependency integrity guidance.

Review before installing in any real energy or device-control environment. Use only with authorized systems, prefer simulation or staging first, pin and verify every dependency, restrict controller credentials to approved devices and setpoint ranges, require human approval for new peers and dispatch actions, and document how to remove or rotate the ~/.pilot setup manifest.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49

Finding

Unpinned Third-Party Skill Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:49-56; duplicated in README.md:48-62
Vulnerability Type: Unpinned and unaudited third-party dependencies
Risk Level: Medium

Vulnerable code in SKILL.md:

bash

# For sensor-mesh:
clawhub install pilot-stream-data pilot-metrics pilot-gossip
# For forecaster:
clawhub install pilot-dataset pilot-task-router pilot-cron
# For optimizer:
clawhub install pilot-consensus pilot-event-filter pilot-audit-log
# For controller:
clawhub install pilot-webhook-bridge pilot-receipt pilot-alert

Corresponding code in README.md:

bash

# On sensor aggregation server
clawhub install pilot-stream-data pilot-metrics pilot-gossip
pilotctl set-hostname <your-prefix>-sensor-mesh

# On forecasting server
clawhub install pilot-dataset pilot-task-router pilot-cron
pilotctl set-hostname <your-prefix>-forecaster

# On optimization server
clawhub install pilot-consensus pilot-event-filter pilot-audit-log
pilotctl set-hostname <your-prefix>-optimizer

# On device control server
clawhub install pilot-webhook-bridge pilot-receipt pilot-alert
pilotctl set-hostname <your-prefix>-controller

Technical Analysis

The setup procedure installs twelve third-party Skills from ClawHub using mutable package names without specifying immutable versions, cryptographic hashes, verified publisher identities, or a dependency lockfile. Consequently, the content installed when these commands are run may differ from the content originally reviewed.

The external dependencies are not included in this project, so their instructions, scripts, transitive dependencies, and runtime behavior cannot be verified by this audit. This is particularly significant because the dependencies are assigned operational capabilities involving sensor ingestion, scheduled jobs, inter-agent communication, webhooks, audit data, and physical-device control.

An ...[truncated 2259 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every ClawHub dependency to a reviewed, immutable version or content digest rather than resolving only by package name.
2. Maintain a dependency lockfile recording exact versions, hashes, publishers, and approved transitive dependencies.
3. Verify package signatures and publisher identities before installation, and fail closed if verification is unavailable or unsuccessful.
4. Mirror approved packages into a controlled internal registry and restrict installations to an explicit allowlist.
5. Audit the complete contents of every dependency, including Skill instructions, scripts, hooks, and transitive packages, before promotion.
6. Test dependency updates in an isolated staging environment and require explicit security approval before production deployment.
7. Run each role with least privilege. In particular, restrict controller credentials and device APIs to approved devices, actions, and safe setpoint ranges.
8. Require independent authorization and safety validation before dispatch commands can affect physical equipment.
9. Monitor installed package integrity and alert on unexpected version, digest, publisher, or dependency changes.
10. Update both SKILL.md and README.md so all installation examples use the same verified, pinned dependency identifiers.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly describes a controller agent that sends live commands to power devices such as inverters, batteries, HVAC systems, and EV chargers, but it does not warn that these actions can affect physical equipment and grid stability. In an energy-management context, encouraging direct dispatch without operator approval gates, simulation/dry-run guidance, or safety interlocks can lead to unsafe or unauthorized actuation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The trust model states that once both sides send a handshake, trust is automatically approved with no manual review. In a multi-agent system that can ultimately issue dispatch commands to physical infrastructure, auto-approving trust relationships increases the chance of unauthorized or mistaken peer enrollment, which could allow malicious or misconfigured agents to send accepted commands or data.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# sensor-mesh <-> forecaster (grid readings)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill sets up a controller role that can send live dispatch commands to inverters and batteries, but it does not warn the user that following the workflow may affect real energy infrastructure. In this context, omission of a safety warning increases the chance of an operator applying the setup to production systems without validation, potentially causing unsafe device actions or service disruption.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Writing the manifest to ~/.pilot/setups/energy-grid-optimizer.json introduces session persistence by storing deployment state across runs. In an operational energy-management context, persisted role, hostname, and peer information can be reused unintentionally, leading to stale trust relationships, accidental reconnection to production peers, or exposure of infrastructure metadata on disk.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

clawhub install pilot-webhook-bridge pilot-receipt pilot-alert

text

**Step 3:** Set the hostname and write the manifest to `~/.pilot/setups/energy-grid-optimizer.json`.

**Step 4:** Tell the user to initiate handshakes with the peers for their role.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The procedure instructs writing a manifest into the user's home directory without warning that this creates persistent local state. While common for configuration, undisclosed persistence can surprise users, leave sensitive topology details on disk, and complicate cleanup on shared or managed hosts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.