Pilot Feedback Collector Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:55 AM UTC
• Version: 1.0.0

Overview

This setup skill is mostly purpose-aligned, but it needs review because it uses broad Bash setup commands, unpinned skill installs, persistent Pilot configuration, auto-approved agent trust, and customer-feedback routing to Slack/webhooks without enough safeguards.

Review and constrain this skill before installing. Use a simple validated prefix, inspect every command before Bash execution, pin and verify all installed skills, confirm peer identities before handshakes, and avoid sending raw customer identifiers or sensitive feedback to Slack or webhooks unless those destinations are approved and access-controlled.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:51

Finding

Unquoted User-Controlled Prefix Can Cause Shell Command Injection

Content

View full analysis

- ``` ``` `SKILL.md:98-108` ```bash # intake <-> analyzer: pilotctl --json handshake -analyzer "setup: feedback-collector" pilotctl --json handshake -intake "setup: feedback-collector" # analyzer <-> router: pilotctl --json handshake -router "setup: feedback-collector" pilotctl --json handshake -analyzer "setup: feedback-collector" ``` `README.md:31-42` ```bash # On server 1 (feedback intake) clawhub install pilot-stream-data pilot-chat pilot-archive pilotctl set-hostname -intake # On server 2 (sentiment analyzer) clawhub install pilot-event-filter pilot-metrics pilot-task-router pilotctl set-hostname -analyzer # On server 3 (feedback router) clawhub install pilot-alert pilot-slack-bridge pilot-webhook-bridge pilotctl set-hostname -router ``` `README.md:49-59` ```bash # intake <-> analyzer # On intake: pilotctl handshake -analyzer "setup: feedback-collector" # On analyzer: pilotctl handshake -intake "setup: feedback-collector" # analyzer <-> router # On analyzer: pilotctl handshake -router "setup: feedback-collector" # On router: pilotctl handshake -analyzer "setup: feedback-collector" ``` `README.md:70-80` ```bash # On -analyzer -- subscribe to raw feedback from intake: pilotctl subscribe -intake raw-feedback # On -router -- subscribe to scored feedback: pilotctl subscribe -analyzer scored-feedback # On -intake -- publish raw feedback: pilotctl pub ...[truncated 2217 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40

Finding

External Skills Are Installed Without Version or Integrity Pinning

Content

View full analysis

-intake # On server 2 (sentiment analyzer) clawhub install pilot-event-filter pilot-metrics pilot-task-router pilotctl set-hostname -analyzer # On server 3 (feedback router) clawhub install pilot-alert pilot-slack-bridge pilot-webhook-bridge pilotctl set-hostname -router ``` ### Technical Analysis The setup installs nine external skills by mutable package name. It does not specify exact versions, integrity hashes, publisher signatures, a lock file, or an explicitly trusted registry. The project also depends on `pilot-protocol`, `pilotctl`, and `clawhub`, but does not document verification requirements for these components. Because the external package contents are not included in the audited project, their implementation and future behavior cannot be established from the reviewed files. Name-only resolution allows the installed artifact to change after this skill has been reviewed. This finding identifies a supply-chain weakness; it does not establish that any named dependency is currently malicious. ### Attack Path 1. An attacker compromises a dependency publisher account, registry, distribution channel, or package release process. ...[truncated 1125 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly routes customer feedback to Slack and webhooks, and the example payloads include customer identifiers and free-text feedback that may contain sensitive or personal data. Without any warning, minimization guidance, or redaction requirements, users may forward regulated or confidential customer content into third-party systems and broader team channels.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The trust model auto-approves a relationship once both sides exchange handshakes, with no documented manual verification of identity, out-of-band confirmation, or approval workflow. In a multi-agent deployment, this can lead operators to establish trust with the wrong peer due to spoofing, misconfiguration, or social engineering, enabling unauthorized data exchange between agents.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# intake <-> analyzer

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly routes customer feedback to Slack channels and external webhooks, but provides no guidance on minimizing, anonymizing, or validating the data before transmission. Because feedback commonly contains personal data, support content, or sensitive business context, this can cause unintentional disclosure to third-party systems or overly broad internal audiences.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/feedback-collector.json << 'MANIFEST'

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The markdown directs the agent to create a directory and write ~/.pilot/setups/feedback-collector.json, which modifies the user's filesystem. For markdown skills, file-affecting behavior should be disclosed so users understand that setup will create or overwrite local configuration artifacts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.