ClawHub
Back to skill

Security audit

Pilot Legal Contract Review Setup

Security checks for vulnerabilities and agentic risk

Overview

This setup is coherent for a legal contract review pipeline, but it handles sensitive contracts with archiving, external webhook delivery, auto-approved trust, and unpinned installs without enough safeguards.

Install only after confirming the Pilot skills and publishers are trusted, pinning reviewed versions where possible, restricting webhook destinations, defining contract retention rules, and verifying peer identities before handshakes. Treat this as a sensitive legal-data pipeline, not a local-only helper.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:41
Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content
View full analysis
-extractor # On server 2 (risk assessor) clawhub install pilot-event-filter pilot-alert pilot-priority-queue pilotctl set-hostname -assessor # On server 3 (summary generator) clawhub install pilot-announce pilot-webhook-bridge pilot-receipt pilotctl set-hostname -summarizer ``` ### Technical Analysis The setup installs nine third-party skills solely by package name. It does not specify immutable versions or content digests, verify package signatures or publisher identities, or constrain installation to a documented trusted registry. The implementations of these dependencies are not included in the audited project, so their behavior cannot be verified from the supplied files. Because package names resolve at installation time, the effective code may change after this skill has been reviewed. A compromised publisher account, registry compromise, dependency substitution, or malicious future release could therefore introduce code that runs with the permissions granted to the installed skill. This is particularly sensitive because the pipeline is intended to process legal contracts and allows installed skills to receive, archive, transmit, and externally deliver contract-derived information. ### Attack Path 1. An attacke ...[truncated 1338 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:38
Finding

Unsanitized User-Controlled Prefix Is Interpolated into Shell Commands and Configuration

Content
View full analysis
- mkdir -p ~/.pilot/setups ``` Then write the role-specific JSON manifest to `~/.pilot/setups/legal-contract-review.json`. ``` The same user-controlled value is later inserted into handshake commands at `SKILL.md:159-164`: ```bash # extractor <-> assessor: pilotctl --json handshake -assessor "setup: legal-contract-review" pilotctl --json handshake -extractor "setup: legal-contract-review" # assessor <-> summarizer: pilotctl --json handshake -summarizer "setup: legal-contract-review" pilotctl --json handshake -assessor "setup: legal-contract-review" ``` ### Technical Analysis The skill explicitly asks the user to provide a prefix and then directs the agent to substitute that value into Bash commands and JSON manifests. No permitted character set, maximum length, hostname validation, shell escaping, or structured JSON serialization requirement is defined. If an implementing agent performs direct textual substitution and invokes the resulting command through a shell, metacharacters in the prefix can change command parsing. Characters such as semicolons, command substitutions, newlines, redirection operators, or shell expansion syntax could introduce an ad ...[truncated 2056 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly states that uploaded contracts are archived for audit purposes and that final reports are delivered via webhook, but it provides no warning, consent step, retention guidance, or controls around what legal data is stored or transmitted externally. Because the data involved is highly sensitive commercial/legal content, silent retention and external transmission materially increase the risk of confidentiality breaches, compliance violations, and unintended disclosure to third parties.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The README describes trust being auto-approved whenever both sides exchange handshakes, with no manual verification of peer identity, authorization, or expected role. In a multi-agent pipeline handling sensitive legal documents, this can allow misbinding or unauthorized agent pairing if hostnames are spoofed, commands are misdirected, or operators establish trust with the wrong peer, enabling confidential data to flow to an unintended system.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash
# extractor <-> assessor (clause data flow)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

clawhub install pilot-announce pilot-webhook-bridge pilot-receipt

text

**Step 3:** Set the hostname and write the manifest:
```bash
pilotctl --json set-hostname <prefix>-<role>
mkdir -p ~/.pilot/setups

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly configures a summarizer to send contract-summary data to an external peer over port 443 and install a webhook bridge, but the user-facing description does not clearly warn that potentially sensitive contract contents, extracted clauses, and summaries may leave the local multi-agent environment. For legal workflows, this omission can cause users to deploy external data egress without informed consent, creating confidentiality, privacy, and compliance risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.