Pilot Media Monitoring Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:10 AM UTC
• Version: 1.0.0

Overview

This setup skill is coherent for media monitoring, but it asks an agent to install many unpinned skills, create trusted agent links, and send reports externally without enough scoping safeguards.

Review before installing. Use only a simple hostname-safe prefix, inspect and pin every dependency skill before running the install commands, confirm the exact Slack/webhook destinations and data allowed to leave the environment, and verify peer identities before accepting trust relationships.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:52

Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: README.md:42

Finding

User-Controlled Prefix Is Inserted into Shell Command Templates Without Validation

Content

View full analysis

-crawler # On sentiment analysis server clawhub install pilot-event-filter pilot-metrics pilot-task-router pilotctl set-hostname -sentiment-analyzer # On trend detection server clawhub install pilot-dataset pilot-alert pilot-gossip pilotctl set-hostname -trend-detector # On reporting server clawhub install pilot-slack-bridge pilot-webhook-bridge pilot-announce pilotctl set-hostname -reporter ``` ```bash # crawler <-> sentiment-analyzer (media mentions) # On crawler: pilotctl handshake -sentiment-analyzer "setup: media-monitoring" # On sentiment-analyzer: pilotctl handshake -crawler "setup: media-monitoring" # sentiment-analyzer <-> trend-detector (scored mentions) # On sentiment-analyzer: pilotctl handshake -trend-detector "setup: media-monitoring" # On trend-detector: pilotctl handshake -sentiment-analyzer "setup: media-monitoring" # trend-detector <-> reporter (trend alerts) # On trend-detector: pilotctl handshake -reporter "setup: media-monitoring" # On reporter: pilotctl handshake -trend-detector "setup: media-monitoring" ``` ### Technical Analysis The setup asks the user to choose a deployment prefix and then places that value directly into Bash command templates. Neither file defines an allowed character set, maximum length, canonicalization procedure, or requirement to pass the value as a non-shell argument. If an agent implements the instructions by performing textual substitution and sends the r ...[truncated 1921 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The reporter role explicitly sends media briefings to Slack and webhooks, but the skill metadata and setup guidance do not prominently warn users that potentially sensitive monitoring results will be transmitted to external third-party destinations. This can lead to unintentional data disclosure, especially in a media intelligence workflow that may process embargoed, customer, or crisis-related information.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The trust model auto-approves peers once both sides send a handshake, removing a human verification step before inter-agent communication is enabled. If an operator mis-targets a hostname, uses a spoofed naming convention, or an attacker gains the ability to initiate reciprocal handshakes, unauthorized agents could be trusted and receive internal media data or inject false alerts into the pipeline.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# crawler <-> sentiment-analyzer (media mentions)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The reporter role installs Slack and webhook bridge skills and is documented to send media-briefing data to external on port 443, but the skill description does not prominently warn that collected media intelligence may be transmitted to third-party systems. This can cause unintended data disclosure if users deploy the reporter without understanding that alerts, briefings, or sensitive trend data may leave the local environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

clawhub install pilot-slack-bridge pilot-webhook-bridge pilot-announce

text

**Step 3:** Set the hostname and write the manifest to `~/.pilot/setups/media-monitoring.json`.

**Step 4:** Tell the user to initiate handshakes with the peers for their role.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown explicitly instructs the agent to write a manifest to ~/.pilot/setups/media-monitoring.json, which affects user filesystem state. There is no nearby warning or disclosure about modifying files in the user's home directory or overwriting an existing manifest.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.