Pilot Mcp Bridge Fleet Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:34 AM UTC
• Version: 1.0.0

Overview

The skill matches its bridge-fleet purpose, but it sets up trusted networked agents with unpinned add-on installs and limited peer-verification guidance.

Review this before installing in any sensitive environment. Verify each peer’s identity before mutual handshakes, pin or verify the installed skills where possible, and avoid routing confidential tool inputs or outputs unless the Pilot transport, trust model, logging, and local manifest permissions meet your requirements.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49

Finding

Unpinned Third-Party Skill Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-55
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The setup procedure installs eleven third-party Skills without specifying immutable versions, content digests, verified publishers, or trusted source locations:

bash

# mcp-gateway:
clawhub install pilot-mcp-bridge pilot-api-gateway pilot-health pilot-metrics
# a2a-bridge:
clawhub install pilot-a2a-bridge pilot-task-router pilot-audit-log
# tool-registry:
clawhub install pilot-directory pilot-discover pilot-announce-capabilities pilot-load-balancer

Technical Analysis

Each installation command resolves mutable package names through the external clawhub registry. The repository does not constrain dependency resolution to reviewed releases or verify the integrity and provenance of downloaded content.

Skill dependencies can contain executable code or agent instructions. Consequently, a compromised publisher account, registry compromise, dependency substitution, or malicious future release could cause users to install content that differs from the content originally reviewed. The granted Bash capability increases the potential consequence if an installed Skill supplies malicious commands.

The same unsafe installation pattern is repeated in README.md, lines 40-50.

Attack Path

1. An attacker compromises a publisher account or the package-distribution channel for one of the named Skills, or publishes an unsafe update through another applicable supply-chain attack.
2. The attacker changes the mutable package release to include malicious instructions or executable behavior.
3. A user follows the documented setup and runs the unpinned clawhub install command.
4. clawhub resolves and installs the attacker-controlled package rather than a previously reviewed immutable release.
5. The malicious dependency executes or influences the agent when invoked, within the p ...[truncated 680 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every Skill dependency to a reviewed, immutable version and preferably a cryptographic content digest.
• Verify package signatures, publisher identity, and expected source repository before installation.
• Configure clawhub to use an explicitly trusted registry and reject unsigned or unverifiable packages.
• Maintain a lockfile or equivalent manifest recording exact resolved versions and integrity hashes.
• Review transitive dependencies and package contents, including scripts and agent instructions, before deployment.
• Test updates in an isolated environment and require an explicit security review before changing pinned versions.
• Apply least-privilege controls so installed Skills receive only the filesystem, network, and command permissions required for their roles.
• Update both SKILL.md and README.md so all installation examples use the same verified, pinned dependency references.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The phrase 'Auto-approved when mutual' indicates trust can be established automatically once both sides initiate a handshake, with no documented human verification of identity, peer authorization, or out-of-band fingerprint checking. In a cross-agent bridge and registry topology, this can allow an attacker controlling a similarly named or compromised node to gain trusted status and then register tools, receive routed tasks, or influence traffic flows.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

2. Establish trust

Both bridges trust the registry. Each bridge handshakes the registry, and the registry handshakes each bridge. Auto-approved when mutual.

bash

# mcp-gw <-> tool-registry

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest and overview describe this skill as deploying an MCP and A2A bridge fleet with 3 agents, implying a full multi-agent setup. But Step 1 instructs the operator to ask the user 'which role and prefix,' which contradicts the fleet-level intent by turning the procedure into a per-role setup flow.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill directs the agent to persist a manifest under ~/.pilot/setups/, creating session-persistent state on disk. Persisted manifests can expose topology, hostnames, roles, and integration details to later sessions or other local users/processes, especially if file permissions and lifecycle management are not addressed.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

clawhub install pilot-directory pilot-discover pilot-announce-capabilities pilot-load-balancer

text

**Step 3:** Set hostname and write manifest to `~/.pilot/setups/mcp-bridge-fleet.json`.

**Step 4:** Both bridges handshake the registry.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs deployment of components that transmit tool registrations, tool calls, and results over the network, but it does not warn users that operational metadata and potentially sensitive tool inputs/outputs will traverse the Pilot network. In a cross-protocol bridge context, missing disclosure increases the risk of users exposing internal capabilities or sensitive payloads without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file documents cross-host registration and routing of tools, agents, tasks, and tool-call payloads, which can affect privacy because capability metadata and message contents are transmitted over the network. Although encryption and trust-gating are mentioned, there is no explicit user-facing warning that setup and example commands will send registration data and task/tool payloads between systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.