Security audit

Pilot Game Npc Network Setup

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for setting up a game NPC network, but it needs review because it installs many unpinned skills and creates automatic trust links using under-validated shell command templates.

Install only after reviewing the dependent skills, pinning or otherwise verifying exact package versions, and running setup from a least-privileged account. Use a simple validated prefix such as lowercase letters, numbers, and hyphens only, and manually verify each peer identity before accepting trust links. Expect persistent Pilot configuration under ~/.pilot.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:52
Finding: Unpinned Third-Party Skill Installations Create a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: README.md:47
Finding: Unquoted User-Supplied Prefix Can Alter Bash Command Parsing
Content: View full analysis
` with a unique name for your deployment (e.g. `darkhollow`). ### 1. Install skills on each server ```bash # On npc-villager node clawhub install pilot-chat pilot-gossip pilot-presence pilot-directory pilotctl set-hostname -npc-villager # On npc-merchant node clawhub install pilot-escrow pilot-stream-data pilot-receipt pilot-auction pilotctl set-hostname -npc-merchant # On npc-guard node clawhub install pilot-watchdog pilot-alert pilot-blocklist pilot-gossip pilotctl set-hostname -npc-guard # On narrative-director node clawhub install pilot-task-router pilot-consensus pilot-event-filter pilot-announce pilotctl set-hostname -narrative-director ``` ``` The same unquoted substitution pattern is used by handshake commands in `README.md`, lines 74-103, and by workflow commands and manifest guidance in `SKILL.md`. ### Technical Analysis The skill explicitly asks the user to choose a deployment prefix and then substitutes that value into Bash command templates without quoting or validating it. No hostname character policy or input-validation step is defined. If an AI agent performs literal string substitution and submits the resulting command to Bash, shell metacharacters contained in the prefix can be interpreted as command syntax rather than hostname data. Characters such as command separators, command substitutions, redirection operators, or whitespace can alter the intended command. The same value is reused across hostname, handshake, publishing, and manifest-generation operations. Unsafe reuse increases the number of possible execution points and may also produce malformed configuration data. Exploitation requires an implementation or agent to interpolate an attacker-c ...[truncated 1350 chars]
Remediation: View remediation
&2 exit 1 fi pilotctl set-hostname "${prefix}-npc-villager" ``` 6. Apply context-specific encoding when the prefix is written to JSON; use a JSON serializer rather than string concatenation. 7. Repeat the validation requirement explicitly before hostname, handshake, publish, and manifest-generation steps. 8. Add tests using malicious prefixes to verify that invalid values are rejected before any Bash command is constructed. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 92% confidence
Finding: The README explicitly describes a trust model where reciprocal handshakes result in automatic trust approval with no manual verification step. In a multi-agent network, this weakens admission control: any agent that can induce or spoof a mutual handshake may gain trusted status and send commands or state updates that influence guard behavior, economy events, or narrative actions.
Content: Scanner excerpt · README.md (reported line 68)May include surrounding context.
2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash
# npc-villager <-> narrative-director

Session Persistence