ClawHub
Back to skill

Security audit

Pilot Etl Data Pipeline Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for ETL setup, but it grants broad production data-flow and trust-establishment authority without enough scoping or review safeguards.

Review this skill before installing in production. Use only trusted, pinned Pilot dependencies; validate the deployment prefix as a hostname-safe value; verify peer identities before handshakes; approve the exact manifest, peers, ports, and external destinations; and ensure Slack/webhook reports contain only non-sensitive aggregates.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:46
Finding

Unpinned Third-Party Skill Dependencies

Content
View full analysis
-ingest # On transform server clawhub install pilot-task-router pilot-stream-data pilot-task-parallel pilotctl set-hostname -transform # On validation server clawhub install pilot-task-router pilot-audit-log pilot-alert pilot-quarantine pilotctl set-hostname -validate # On loader server clawhub install pilot-database-bridge pilot-task-chain pilot-receipt pilotctl set-hostname -loader # On reporting server clawhub install pilot-webhook-bridge pilot-metrics pilot-slack-bridge pilot-cron pilotctl set-hostname -reporter ``` ### Technical Analysis Each `clawhub install` invocation resolves packages solely by name. The reviewed files do not constrain resolution to an immutable, previously reviewed release or digest and do not require integrity or publisher checks. Consequently, the instructions executed during deployment may differ from those reviewed during this audit. This creates a supply-chain exposure if a package is comprom ...[truncated 1505 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:44
Finding

Potential Shell Command Injection Through Unvalidated Deployment Prefix

Content
View full analysis
` with a unique name for your deployment (e.g. `acme`). ### 1. Install skills on each server ```bash # On ingestion server clawhub install pilot-s3-bridge pilot-database-bridge pilot-task-chain pilot-cron pilotctl set-hostname -ingest # On transform server clawhub install pilot-task-router pilot-stream-data pilot-task-parallel pilotctl set-hostname -transform # On validation server clawhub install pilot-task-router pilot-audit-log pilot-alert pilot-quarantine pilotctl set-hostname -validate # On loader server clawhub install pilot-database-bridge pilot-task-chain pilot-receipt pilotctl set-hostname -loader # On reporting server clawhub install pilot-webhook-bridge pilot-metrics pilot-slack-bridge pilot-cron pilotctl set-hostname -reporter ``` ``` The same prefix is also interpolated into handshake a ...[truncated 2350 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README explicitly describes production data movement across multiple agents and to Slack dashboards/summaries, but provides no guidance on minimizing data contents, avoiding sensitive fields, or securing outbound reporting channels. In an ETL context, pipeline metrics, validation errors, and sample records can easily contain sensitive business or personal data, so normalizing this flow without warnings increases the risk of inadvertent data exposure.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 74)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash
# On ingest:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The setup instructions tell operators that mutual handshakes result in trust being auto-approved with no manual review, but do not warn about the consequences of establishing bidirectional trust between agents handling production ETL data. If a hostname is mistyped, spoofed, or an unintended agent participates, the workflow could authorize unauthorized data exchange across ingestion, validation, loading, and reporting boundaries.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The instruction to write a manifest to ~/.pilot/setups/etl-data-pipeline.json creates session-persistent state on disk without any guardrails around overwrite behavior, retention, or user approval. Persistent configuration can silently affect later runs, expose pipeline topology and peers, or cause subsequent automation to act on stale or attacker-influenced settings.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

clawhub install pilot-webhook-bridge pilot-metrics pilot-slack-bridge pilot-cron

text

**Step 3:** Set hostname and write manifest to `~/.pilot/setups/etl-data-pipeline.json`.

**Step 4:** Handshake with adjacent pipeline stages.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs the agent to install components, write a persistent manifest, and establish inter-agent data flows and handshakes, but it provides no explicit requirement to warn the user that these actions modify local configuration and may transmit operational or sensitive pipeline data to other hosts and external integrations. In an ETL context, that omission is meaningful because the pipeline includes database, S3, webhook, and Slack-related bridges, increasing the chance of unintended data movement or system-side effects without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.