Pilot Event Bus

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:36 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Pilot Protocol event-bus guide; the main risks are security-sensitive trust setup and copy-paste shell examples that need care.

Install only if you already use Pilot Protocol and understand which agents should be trusted. Do not let an agent run the handshake command automatically; verify the hostname and reason first. If adapting the examples, quote all dynamic values and avoid the fixed /tmp/events.json path.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:40

Finding

Potential Shell Command Injection Through Unquoted Command Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40–60
Vulnerability Type: Shell command injection caused by unsafe parameter interpolation
Risk Level: High

Vulnerable Code

bash

pilotctl --json publish <target-hostname> <topic> --data <payload>

bash

pilotctl --json subscribe <target-hostname> <topic> [--timeout <seconds>]

bash

pilotctl --json find <hostname>

bash

pilotctl --json handshake <hostname> "reason for trust request"

Technical Analysis

The documented command templates place dynamic hostnames, topics, payloads, and timeout values directly into shell commands without demonstrating shell-safe quoting or validation. If an agent substitutes an attacker-controlled value into one of these templates, shell metacharacters such as semicolons, redirections, command substitutions, or pipeline operators may be interpreted by the shell before pilotctl receives the arguments.

For example, a malicious hostname containing a command separator could cause an additional command to execute if it is inserted verbatim into the template. Payload values present additional risk because event data may originate from external agents or other untrusted workflow inputs.

Exploitation depends on the calling agent constructing the Bash command through direct textual interpolation. Passing arguments without a shell or using correctly quoted variables would prevent this attack.

Attack Path

1. An attacker controls or influences a hostname, topic, payload, or timeout supplied to the skill.
2. The attacker includes shell syntax or command substitution in that value.
3. The agent inserts the value verbatim into one of the documented Bash command templates.
4. Bash interprets the injected syntax before invoking pilotctl.
5. The injected command executes with the operating-system privileges of the agent process.

I

...[truncated 468 chars]

Remediation

View remediation

Remediation Suggestions

• Store every dynamic value in a variable and quote each expansion:

  bash

  pilotctl --json publish "$target_hostname" "$topic" --data "$payload"
  

• Prefer direct process invocation with an argument array rather than constructing a shell command string.
• Apply strict allowlist validation:
  • Hostnames should contain only permitted DNS hostname characters.
  • Topics should conform to the documented dotted topic syntax.
  • Timeouts should contain digits only and be constrained to a reasonable range.
• Reject control characters, newlines, shell metacharacters, and unexpected option prefixes where they are not explicitly allowed.
• Use -- before positional arguments if pilotctl supports an end-of-options delimiter.
• Treat all values received from remote agents or event payloads as untrusted input.
• Add negative tests using values containing semicolons, command substitutions, redirections, newlines, and leading hyphens.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:70

Finding

Predictable Shared Temporary File Enables File Clobbering and Workflow Interference

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 70–76
Vulnerability Type: Unsafe predictable temporary-file handling
Risk Level: Medium

Vulnerable Code

bash

pilotctl --json trust | jq -r '.data.trusted[].hostname'

pilotctl --json subscribe fleet-coordinator "tasks.assigned.*" --timeout 300 > /tmp/events.json &

pilotctl --json publish fleet-coordinator "tasks.assigned.worker-1" \
  --data "{\"task_id\":\"task-123\",\"assigned_at\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}"

jq -r '.data.events[] | "\(.timestamp): \(.topic) -> \(.data)"' /tmp/events.json

Technical Analysis

The workflow writes event data to the fixed, globally predictable path /tmp/events.json using ordinary shell redirection. The path is neither created securely nor restricted to a private temporary directory.

On systems where symbolic-link protections do not block the operation, another local user may pre-create this path as a symbolic link to a file writable by the victim. Shell redirection can then follow the link and truncate or overwrite the target file. System hardening such as Linux protected-symlink settings may mitigate some variants, but the example remains unsafe and non-portable.

The fixed path also creates a deterministic race between concurrent skill executions. One execution may truncate or replace another execution's event data, and a local process able to access the file may read or alter event contents. In addition, the subscription is started in the background without capturing its process ID or waiting for completion before jq reads the file, which can cause partial reads or inconsistent results.

Attack Path

1. A local attacker predicts the documented /tmp/events.json path.
2. The attacker creates a conflicting file or, where operating-system protections permit, a symbolic link at that path.
3. The victim executes the documented workflow.
4. Shell redirection truncates the confl ...[truncated 824 chars]

Remediation

View remediation

Remediation Suggestions

• Create a unique private temporary directory and ensure automatic cleanup:

  bash

  tmp_dir="$(mktemp -d)" || exit 1
  trap 'rm -rf -- "$tmp_dir"' EXIT
  events_file="$tmp_dir/events.json"
  

• Set a restrictive umask, such as umask 077, before creating files that may contain event data.
• Do not use a fixed filename in a globally writable directory.
• Capture the background process ID and wait for the subscription to finish before processing its output:

  bash

  pilotctl --json subscribe fleet-coordinator "tasks.assigned.*" \
    --timeout 300 > "$events_file" &
  subscriber_pid=$!
  
  # Publish the event here.
  
  wait "$subscriber_pid" || exit 1
  jq -r '.data.events[] | "\(.timestamp): \(.topic) -> \(.data)"' "$events_file"
  

• Validate that temporary-file creation succeeded and handle subscription or parsing failures explicitly.
• Avoid retaining event data longer than required, particularly when payloads may contain sensitive information.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest says not to use this skill for 'filtered or transformed events,' implying the bus is only for unfiltered shared-topic aggregation and broadcast. However, the documented code demonstrates subscribing to tasks.assigned.* and later advertises wildcards like tasks.* and alerts.error.*, which are topic-level filters and therefore broader than the stated limitation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Including trust establishment commands in an event-bus skill expands the skill from message exchange into access onboarding. Because mutual trust is a prerequisite for participation, exposing pilotctl --json handshake within this skill can encourage operators or agents to grant trust in the course of routine event-bus use, increasing the chance of unauthorized enrollment or social-engineered trust relationships.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.