Pilot Fleet Health Monitor Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:04 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent fleet-monitoring setup guide, but it asks users to install mutable agent skills, establish auto-approved trust, and send operational alerts externally without enough scoping safeguards.

Review this before installing in production. Use a trusted registry, pin exact versions or digests for the required skills, validate the deployment prefix as a simple hostname-safe value, verify peer identities before handshakes, and confirm what alert fields will be sent to Slack or PagerDuty.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:46

Finding

Unpinned Third-Party Skills Create a Supply-Chain Execution Risk

Content

View full analysis

-web-monitor # On server 2 (database) clawhub install pilot-health pilot-alert pilot-metrics pilotctl set-hostname -db-monitor # On server 3 (alert aggregator) clawhub install pilot-webhook-bridge pilot-alert pilot-event-filter pilot-slack-bridge pilotctl set-hostname -alert-hub ``` ### Technical Analysis The setup installs seven third-party skills solely by package name: - `pilot-health` - `pilot-alert` - `pilot-metrics` - `pilot-webhook-bridge` - `pilot-event-filter` - `pilot-slack-bridge` No exact versions, immutable content hashes, trusted source URLs, publisher identities, or signature-verification requirements are specified. Consequently, the content installed during deployment can differ from the content that was originally reviewed. Because these dependencies provide monitoring, webhook, metrics, and alerting functionality, they may interact with system health data, databases, network services, and external notification endpoints. Their source and behavior are not included in this project and therefore could not be audited. This is a supply-chain weakness rather than proof that any named dependency is currently malicious. Exploitation requires compromise, replacement, dependency confusion, or unauthorized modification of one of the registry packages or its distribution channel. ### Attack Path 1. An attacker compromi ...[truncated 1471 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:53

Finding

User-Controlled Prefix Is Embedded into Shell Commands Without Validation or Quoting

Content

View full analysis

- ``` ``` The same unquoted substitution pattern is used in handshake operations: ```bash # web-monitor and db-monitor handshake with alert-hub: pilotctl --json handshake -alert-hub "setup: fleet-health-monitor" # alert-hub handshakes with both monitors: pilotctl --json handshake -web-monitor "setup: fleet-health-monitor" pilotctl --json handshake -db-monitor "setup: fleet-health-monitor" ``` It is also used in subscription and publication commands: ```bash # On alert-hub — subscribe to health events: pilotctl --json subscribe -web-monitor health-alert pilotctl --json subscribe -db-monitor health-alert # On web-monitor — publish a health alert: pilotctl --json publish -alert-hub health-alert '{"host":"web-01","status":"critical","cpu":95,"mem":88}' # On db-monitor — publish a database alert: pilotctl --json publish -alert-hub health-alert '{"host":"db-01","status":"warning","disk_pct":88,"repl_lag_ms":450}' ``` ### Technical Analysis The prefix originates from the user, but the instructions do not define an accepted character set, length limit, or normalization procedure. The placeholder is embedded into shell commands without quoting. If an automated agent performs direct textual substitution and passes the resulting string to a shell, metacharacters such as semicolons, command substitutions, redirections, pipes, or newlines can change the structure of the command. Whi ...[truncated 2308 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file documents that the alert hub forwards critical alerts to Slack and PagerDuty via webhooks, which is a network transmission of potentially sensitive service-health and host data. The setup and data-flow sections do not include any user warning about what data leaves the environment, privacy implications, or the need to review webhook destinations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The trust model auto-approves communication once both sides exchange handshakes, with no documented human verification of peer identity or out-of-band validation. In a fleet setup, this lowers the bar for mistakenly trusting the wrong agent name or a spoofed/unauthorized peer, which could enable false alerts, data exfiltration, or lateral communications between agents.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# On alert-hub:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/fleet-health-monitor.json << 'MANIFEST'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill forwards health alerts to external services such as Slack and PagerDuty but does not warn that operational metadata may leave the local environment. Alert payloads can contain hostnames, service health status, resource usage, and incident details, which may expose sensitive infrastructure information if sent to third-party endpoints without review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown skill instructs the user to create a directory and write ~/.pilot/setups/fleet-health-monitor.json, which changes local configuration state. The document does not include any warning that it will create or overwrite files under the user's home directory or advise reviewing the manifest before running the commands.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.