Pilot Log Analytics Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:01 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent log-analytics setup, but it needs Review because it installs multiple external skills, creates persistent trust/configuration state, and can forward sensitive log reports outside the agent system without enough safeguards.

Install only after reviewing the dependent skills and restricting the deployment to approved log sources, peers, and outbound destinations. Use a simple validated prefix, verify peer identities before handshakes, back up any existing ~/.pilot setup file, and avoid sending raw logs or secrets to Slack or webhooks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:54

Finding

Unpinned and Unaudited Third-Party Skill Installation

Content

View full analysis

-collector # On server 2 (log parser) clawhub install pilot-event-filter pilot-task-router pilot-dataset pilotctl set-hostname -parser # On server 3 (anomaly alerter) clawhub install pilot-alert pilot-metrics pilot-cron pilotctl set-hostname -alerter # On server 4 (log dashboard) clawhub install pilot-webhook-bridge pilot-slack-bridge pilot-announce pilotctl set-hostname -dashboard ``` ### Technical Analysis The setup procedure installs twelve external ClawHub skills using package names alone. It does not specify immutable versions, content hashes, signatures, verified publishers, or trusted source repositories. Consequently, the actual code installed can change after this project has been reviewed. The external packages are not included in the audited project, which contains only `README.md` and `SKILL.md`. Their implementation and security properties therefore cannot be established from this audit. The bridge dependencies are particularly sensitive because the declared architecture permits the dashboard agent to transmit reports to external webhook and Slack destinations. This is a supply-chain weakness rather than evidence that any listed dependency is currently malicious. ### Attack Path 1. An ...[truncated 1566 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:51

Finding

Shell Command Injection Through an Unvalidated Deployment Prefix

Content

View full analysis

- ``` ``` `SKILL.md:139-147`: ```bash # collector <-> parser: pilotctl --json handshake -parser "setup: log-analytics" pilotctl --json handshake -collector "setup: log-analytics" # parser <-> alerter: pilotctl --json handshake -alerter "setup: log-analytics" pilotctl --json handshake -parser "setup: log-analytics" # alerter <-> dashboard: pilotctl --json handshake -dashboard "setup: log-analytics" pilotctl --json handshake -alerter "setup: log-analytics" ``` `README.md:40-59`: ```markdown Replace `` with a unique name for your deployment (e.g. `acme`). ### 1. Install skills on each server ```bash # On server 1 (log collector) clawhub install pilot-stream-data pilot-archive pilot-compress pilotctl set-hostname -collector # On server 2 (log parser) clawhub install pilot-event-filter pilot-task-router pilot-dataset pilotctl set-hostname -parser # On server 3 (anomaly alerter) clawhub install pilot-alert pilot-metrics pilot-cron pilotctl set-hostname -alerter # On server 4 (log dashboard) clawhub install pilot-webhook-brid ...[truncated 3369 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly routes log reports to external dashboards and Slack channels but provides no warning that logs may contain secrets, tokens, PII, stack traces, or internal hostnames. In a log analytics skill, forwarding data to third-party or broad-visibility destinations materially increases the risk of unintended data exposure if users mirror raw or insufficiently sanitized events.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# collector <-> parser

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The setup normalizes automatic trust approval once both sides exchange handshakes, but it does not warn users that this creates an authorization relationship that could allow unintended data exchange if a hostname is mistaken, spoofed, or compromised. Because this skill coordinates multiple agents and sensitive telemetry, implicit approval without verification guidance weakens operator awareness of trust-boundary risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest frames this skill as deploying four agents for collection, parsing, alerting, and visualization, but the dashboard role is assigned pilot-webhook-bridge and pilot-slack-bridge, which enable outbound communication to external systems. While reporting is mentioned later, external integrations are not clearly justified by the core setup purpose and expand the capability from visualization into cross-system message forwarding.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

Writing a persistent manifest under ~/.pilot/setups modifies user state beyond the immediate session and can influence future agent behavior. Because the change is durable and placed in a standard configuration location without explicit consent, it creates a persistence mechanism that may outlive the user's awareness and be abused to maintain unintended configuration.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/log-analytics.json << 'MANIFEST'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The setup writes directly to ~/.pilot/setups/log-analytics.json using shell redirection, which will overwrite any existing file without prompting or backup. This can destroy prior configuration, create hard-to-detect persistence changes, or replace a trusted manifest with unintended settings in a user's long-lived environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs forwarding log reports to external dashboards and Slack but gives no warning that logs and anomaly summaries may contain sensitive operational or personal data. In a log-analytics context, this is especially risky because logs often include tokens, internal hostnames, stack traces, and customer identifiers, so exporting them can cause confidentiality and integrity issues if destinations are misconfigured or unapproved.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The declared flow dashboard -> external on port 443 introduces a capability to transmit log-derived reports outside the four-agent system. The skill description emphasizes centralized collection, parsing, anomaly detection, and dashboards across agents, not external dissemination, so this outbound integration is broader than the manifest's stated purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.