Pilot Ml Training Pipeline Setup

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:35 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed ML pipeline setup helper, but users should review its peer trust, package installs, and artifact-sharing steps before running it.

Before installing, confirm the selected role, prefix, peer hostnames, and exact packages. Treat datasets, model checkpoints, and inference metrics as potentially sensitive, and only complete handshakes with trusted agents in an intended deployment. For production use, prefer pinned or internally approved dependency versions and keep a record of the persistent ~/.pilot manifest so it can be audited or removed later.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49

Finding

Unpinned Third-Party Skill Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49–56
Vulnerability Type: Unpinned third-party dependencies installed from a mutable package source
Risk Level: Medium

Vulnerable Code

bash

# For data-prep:
clawhub install pilot-dataset pilot-share pilot-task-chain
# For trainer:
clawhub install pilot-dataset pilot-model-share pilot-metrics pilot-task-chain
# For evaluator:
clawhub install pilot-model-share pilot-metrics pilot-review pilot-task-chain
# For serving:
clawhub install pilot-model-share pilot-health pilot-webhook-bridge pilot-load-balancer pilot-metrics

Technical Analysis

The setup procedure installs multiple third-party skills by package name without immutable version pins, content digests, checksums, source repository constraints, or documented signature verification. As a result, the content installed in the future may differ from the content originally reviewed.

Because skills can contain executable code or agent instructions, compromise of the package registry, a publisher account, or any named package could introduce attacker-controlled behavior. The serving role installs dependencies with model-transfer, webhook, health-monitoring, load-balancing, and metrics responsibilities, increasing the potential reach of a compromised dependency.

The audit did not establish that any named dependency is currently malicious. The vulnerability is the absence of controls ensuring that only reviewed dependency versions are installed.

Attack Path

1. An attacker compromises a dependency publisher, registry entry, or distribution channel associated with one of the named skills.
2. The attacker publishes a modified package under the expected mutable package name.
3. A user or agent follows the documented clawhub install command.
4. clawhub resolves and installs the attacker-controlled package because no version or digest is specified.
5. The malicious dependency executes with the permissions available to the inv ...[truncated 673 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every dependency to an audited immutable version and, where supported, a cryptographic content digest.
• Verify package signatures, publisher identities, source repositories, and checksums before installation.
• Maintain a lockfile or equivalent approved dependency manifest.
• Review each dependency's instructions, scripts, transitive dependencies, and requested tools independently.
• Use an internal allowlisted registry or trusted mirror for production deployments.
• Install and execute skills with least privilege, restricting Bash, filesystem, credential, and network access to what each role requires.
• Require explicit user approval before installing dependencies or establishing peer trust.
• Continuously scan pinned dependency releases and use a controlled process for upgrades.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README claims there is automatic approval gating before production serving, but the setup section states that mutual handshakes cause trust to be auto-approved with no manual review. This mismatch can cause operators to believe a human approval control exists when in practice peer trust is granted automatically, increasing the chance of unauthorized or insufficiently reviewed model promotion or data exchange.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The setup instructs that when both sides send a handshake, trust is auto-approved with no manual step. In a multi-agent ML pipeline, that creates an autonomous trust decision for channels that carry training data and production models, reducing operator oversight at a sensitive control point and making accidental or unauthorized inter-agent trust easier to establish.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# On data-prep:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The examples instruct users to transfer datasets, model checkpoints, and inference metrics between agents without any explicit warning about sensitivity, privacy, or data governance. In an ML pipeline context, those artifacts often contain proprietary models, regulated training data, or telemetry that can expose business or user information, so omitting warnings and handling guidance can lead to unsafe deployment practices.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill directs writing a role-specific manifest to ~/.pilot/setups/ml-training-pipeline.json, creating persistent configuration that can influence future agent behavior across sessions. Because the content includes peers, ports, topics, and workflow metadata, an incorrect or attacker-influenced setup could silently persist and continue enabling unintended communications later.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the role-specific JSON manifest to `~/.pilot/setups/ml-training-pipeline.json`.

**Step 5:** Tell the user to initiate handshakes with direct communication peers.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to modify system state, write a persistent manifest, and send datasets, models, and metrics to peer hosts without explicitly requiring user confirmation or warning about data sensitivity, network exposure, and operational impact. In an ML pipeline context, these actions can leak proprietary datasets or model artifacts and can trigger unintended cross-host communication if the user does not fully understand the consequences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.