ClawHub
Back to skill

Security audit

Pilot Fraud Detection Pipeline Setup

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent fraud-pipeline setup skill, but it enables high-impact enforcement workflows and unpinned dependency installation without enough safety guardrails for production use.

Review this skill carefully before installing. Use it first in a sandbox or non-production environment, pin and verify every installed pilot skill, confirm peer identities manually before trusting agents, and require human approval for any webhook, blocklist, account-freeze, reversal, or transaction-decline action. Check whether an existing `~/.pilot/setups/fraud-detection-pipeline.json` file will be overwritten and restrict access to that manifest.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:52
Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content
View full analysis
-monitor # On pattern analysis server clawhub install pilot-event-filter pilot-archive pilot-priority-queue pilotctl set-hostname -pattern-analyzer # On investigation server clawhub install pilot-task-router pilot-audit-log pilot-dataset pilotctl set-hostname -investigator # On enforcement server clawhub install pilot-blocklist pilot-webhook-bridge pilot-audit-log pilot-alert pilotctl set-hostname -enforcer ``` ### Technical Analysis The setup instructions install multiple third-party skills using mutable package names without specifying immutable versions, content hashes, publisher signatures, or a constrained registry source. The source code of these dependencies is not included in the audited project, so their behavior and integrity cannot be verified from the repository. Resolving dependencies by name means the installed content can change after this project has been reviewed. If a registry account, distribution channel, or named package is compromised or replaced, subsequent installations may retrieve attacker-controlled content while appearing to follow the legitimate setup instructions. The repository itself contains only documentation and n ...[truncated 1999 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README explicitly describes disruptive enforcement actions such as freezing accounts and declining transactions, but it does not clearly warn operators that these actions can affect real users or production systems. In a fraud pipeline skill, omission of safety guardrails increases the chance that users will deploy or test enforcement behavior against live systems without understanding the operational consequences.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

The trust model states that when both sides send a handshake, trust is auto-approved with no manual review. In a multi-agent system that can exchange fraud verdicts and blocking instructions, automatic mutual trust reduces human oversight and could allow mistakenly trusted or spoofed agents to participate in sensitive decision and enforcement flows.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash
# monitor <-> pattern-analyzer (flagged transactions)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example commands walk the user through publishing a confirmed fraud verdict and blocked-entity message without any warning that downstream agents may execute real blocking behavior. Because this skill sets up an end-to-end pipeline with an enforcer and feedback loop, these examples could trigger actual account restrictions or transaction denials if run in a connected environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
81% confidence
Finding

Writing persistent configuration to ~/.pilot/setups/fraud-detection-pipeline.json creates session persistence on the local machine, which can have security and privacy implications if done without clear consent, validation, or overwrite protections. Persistent manifests may expose topology, peer identities, and operational roles to other local users or be reused unintentionally in later sessions.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

clawhub install pilot-blocklist pilot-webhook-bridge pilot-audit-log pilot-alert

text

**Step 3:** Set the hostname and write the manifest to `~/.pilot/setups/fraud-detection-pipeline.json`.

**Step 4:** Tell the user to initiate handshakes with the peers for their role.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The enforcer role is described as capable of triggering external actions such as freezing accounts or declining transactions, but the skill does not present this as a high-risk operation requiring explicit user awareness and confirmation. In an operational environment, deploying or enabling this role without clear warnings can cause unintended financial or service-denial actions against legitimate users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file instructs the agent to write a manifest to ~/.pilot/setups/fraud-detection-pipeline.json, which affects user system state. The document does not explicitly warn the user that a local configuration file will be created or modified before proceeding.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.