Pilot Meeting Assistant Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:03 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent meeting-assistant setup, but it installs multiple unpinned skills and routes sensitive meeting data through agents and external reminders with limited safety controls documented.

Review this skill before installing in a real workspace. Pin and verify every dependent skill, use a simple hostname-safe prefix, confirm the identity of each peer before handshaking, and make sure your organization permits meeting notes, attendee information, action items, archives, and Slack/webhook reminders to be processed by these agents and destinations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned Third-Party Skill Installation

Content

View full analysis

-scheduler # On server 2 (note taker) clawhub install pilot-stream-data pilot-share pilot-archive pilotctl set-hostname -note-taker # On server 3 (action tracker) clawhub install pilot-task-router pilot-alert pilot-slack-bridge pilotctl set-hostname -action-tracker ``` ### Technical Analysis The setup installs nine third-party skills using only their mutable package names. It does not specify reviewed versions, immutable content digests, package signatures, expected publishers, or an explicitly trusted registry. The source code of these dependencies is not included in the audited project, so their behavior cannot be verified from this repository. Installation by mutable name means that the effective code installed during deployment can differ from the code originally reviewed or expected by the user. The dependencies are particularly sensitive because their documented responsibilities include calendar webhooks, live meeting streams, file sharing, archival storage, task routing, Slack integration, and external alerts. A compromised dependency could therefore operate on meeting content or use the communication capabilities granted to the deployed agent. ### Attack Path 1. An attacker compromises the registry account, pu ...[truncated 1587 chars]

Remediation

View remediation

``` The exact syntax should follow `clawhub` documentation, but the selected identifier must resolve immutably. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:55

Finding

Command Injection Risk Through Unvalidated Setup Prefix

Content

View full analysis

- ``` The same unquoted placeholder is used in handshake commands: ```bash # scheduler and note-taker handshake with each other: pilotctl --json handshake -note-taker "setup: meeting-assistant" pilotctl --json handshake -scheduler "setup: meeting-assistant" # note-taker and action-tracker handshake with each other: pilotctl --json handshake -action-tracker "setup: meeting-assistant" pilotctl --json handshake -note-taker "setup: meeting-assistant" ``` ### Technical Analysis Step 1 of the skill instructs the agent to obtain the deployment prefix from the user. Subsequent Bash templates place that value directly into command text without quoting it or restricting its character set. If an automated agent performs direct textual substitution, shell metacharacters in the supplied prefix can change the syntactic structure of the command. Characters such as command substitutions, separators, redirections, or expansions could cause the shell to execute operations beyond the intended `pilotctl` invocation. The role is also represented as a placeholder in the hostname command. Although the documented roles are fixed, the procedure should enforce an explicit role allowlist rather than relying on the placeholder being replaced safely. This issue applies when the generated command is executed through a shell. It can be avoided by validating values and passing them as discrete process arguments without shell interpretation. ### Attack Path 1. The skill asks a user for the deployment prefix. 2. A malici ...[truncated 1596 chars]

Remediation

View remediation

&2 exit 1 fi ``` 2. Restrict the role to the three documented values: ```bash case "$role" in scheduler|note-taker|action-tracker) ;; *) printf '%s\n' "Invalid role" >&2 exit 1 ;; esac ``` 3. Pass values as quoted arguments: ```bash hostname="${prefix}-${role}" pilotctl --json set-hostname "$hostname" peer="${prefix}-note-taker" pilotctl --json handshake "$peer" "setup: meeting-assistant" ``` 4. Prefer direct process invocation with an argument array or equivalent API rather than constructing a command string and passing it to `bash -c`, `eval`, or another shell. 5. Apply the same validation and quoting rules to every occurrence of the prefix in hostname, handshake, subscribe, and publish commands. 6. Enforce hostname length limits after adding the role suffix. 7. Treat values copied from user messages, manifests, peer messages, or external workflow data as untrusted even when they appear to be identifiers. 8. Add tests covering separators, command substitutions, whitespace, redirection characters, leading hyphens, newlines, and excessive lengths. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file documents a workflow that captures meeting notes, attendee identities, decisions, and sends reminders through downstream systems such as Slack. The description and usage examples include potentially sensitive meeting content and personal contact data, but provide no warning about privacy, confidentiality, or handling of user data.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The trust model auto-approves communication once both sides exchange handshakes, with no documented human verification of peer identity or out-of-band confirmation. If an operator handshakes the wrong host or a spoofed agent using a similar name, unauthorized agents could be trusted and then receive meeting events or notes containing sensitive business information.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# scheduler <-> note-taker

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is explicitly designed to capture, transmit, and archive meeting content, including attendees, decisions, and action items, but it provides no user-facing privacy notice, consent guidance, retention expectations, or warning about handling potentially sensitive business or personal data. In this context, the omission is material because meeting notes often contain confidential information, so operators may deploy the workflow without understanding the privacy and compliance implications.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 79% confidence

Finding

The skill instructs the agent to persist a setup manifest under ~/.pilot/setups, creating durable local state that may outlive the session. While the manifest shown is mostly configuration metadata, it can still reveal internal hostnames, topology, and communication relationships, and the skill provides no warning, lifecycle guidance, or cleanup instructions for that persisted data.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/meeting-assistant.json << 'MANIFEST'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documents sending meeting-derived data to external systems via webhook/Slack-style integrations, but it does not warn the user that internal meeting content may leave the local environment and be exposed to third-party platforms. That increases the risk of accidental disclosure of confidential notes, attendee identities, and action items to external services with different security and retention properties.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.