Pilot Incident Response Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:10 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for incident response setup, but it wires high-impact automation, auto-approved agent trust, and external notifications without enough safety scoping.

Review this before installing in any production or sensitive environment. Pin and verify all referenced skills, restrict each agent to an allowlisted role and peer set, require manual approval for restart/scale/quarantine actions, and redact incident payloads before enabling Slack, email, or webhook forwarding.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:53

Finding

Unpinned Third-Party Operational Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:53-59
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash

# For detector:
clawhub install pilot-watchdog pilot-alert pilot-audit-log pilot-metrics
# For triage:
clawhub install pilot-alert pilot-event-filter pilot-priority-queue pilot-sla
# For remediator:
clawhub install pilot-task-router pilot-cron pilot-audit-log pilot-quarantine
# For notifier:
clawhub install pilot-slack-bridge pilot-email-bridge pilot-webhook-bridge pilot-audit-log

The same unpinned installation instructions are duplicated in README.md:46-58.

Technical Analysis

The Skill directs users or agents to install multiple packages from ClawHub without immutable versions, cryptographic hashes, verified publisher identities, signatures, or a dependency lockfile. Consequently, the effective dependency contents may change after this Skill has been reviewed.

These dependencies are intended to perform security-sensitive operations, including system monitoring, scheduled jobs, automated remediation, node quarantine, audit logging, and outbound Slack, email, and webhook communication. Their implementations are not included in the audited project, so their integrity and exact behavior cannot be verified from this artifact.

The finding does not establish that any named dependency is currently malicious. The vulnerability is the unsafe, mutable supply-chain resolution process used for packages that may receive significant operational access.

Attack Path

1. An attacker compromises a named ClawHub package, its publisher account, or the applicable package namespace.
2. The attacker publishes a malicious release under a package name referenced by the Skill.
3. A user or agent follows the setup instructions and executes an unpinned clawhub install command.
4. ClawHub resolves and installs the attacker-controlled release.
5. The ...[truncated 1117 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every ClawHub dependency to an audited, immutable version or content digest.
2. Record resolved dependency versions and hashes in a committed lockfile or signed manifest.
3. Verify package publisher identities and cryptographic signatures before installation.
4. Restrict installation to an organization-controlled allowlist or trusted internal mirror.
5. Review the complete contents and transitive dependencies of every package before approving upgrades.
6. Test upgrades in an isolated environment and require explicit administrative approval before production rollout.
7. Apply least privilege per role, especially for remediation, quarantine, cron, Slack, email, and webhook capabilities.
8. Run agents in isolated service accounts or sandboxes with narrowly scoped filesystem, network, and credential access.
9. Add integrity monitoring and alerting for installed packages and dependency-manifest changes.
10. Update the duplicate commands in README.md:46-58 to use the same pinned dependency identifiers.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly promotes an auto-remediator that can restart services, scale resources, and quarantine nodes, but provides no guardrails, approval requirements, rollback guidance, or warning about service disruption. In an incident-response context, automated actions against production systems can amplify false positives into outages or isolate healthy systems, making this a real security and reliability risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The notifier is designed to send incident details to Slack, email, and webhooks, yet the documentation gives no warning about transmitting sensitive operational data to third-party systems or external integrations. Incident payloads often contain hostnames, topology, failure details, or indicators of compromise, so forwarding them broadly can create unnecessary data exposure and leak internal security state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trust model states that when both sides send a handshake, trust is auto-approved with no manual review, but the README does not warn users to verify peer identity, secure the handshake channel, or restrict which agents are allowed to pair. In a distributed remediation pipeline, this can let an attacker who can register a lookalike or compromised agent obtain trusted communication paths and influence alerting, remediation, or notifications.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The phrase 'trust is auto-approved -- no manual step needed' describes an autonomous security decision that directly affects authorization between agents. In this skill's context, where agents can trigger remediation and notifications, automatic trust establishment increases the chance that unauthorized or misidentified agents gain privileged influence over the pipeline.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# On detector:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly sets up an automated remediator with capabilities such as restart, scale, and quarantine, but it does not warn the user that these actions can change system state or disrupt services. In an incident-response context, omission of this warning increases the chance that a user enables destructive or availability-impacting automation without informed consent or review gates.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

clawhub install pilot-slack-bridge pilot-email-bridge pilot-webhook-bridge pilot-audit-log

text

**Step 3:** Set the hostname and write the manifest to `~/.pilot/setups/incident-response.json`.

**Step 4:** Tell the user to initiate handshakes.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The notifier role includes Slack, email, and webhook bridges that can send incident data to external services, but the skill provides no privacy or data-sharing warning. This can lead users to forward sensitive incident details, hostnames, or forensic information to third-party systems without understanding retention, access, or compliance implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.