T08 · Insecure Dependencies
Error
- Location
SKILL.md:47- Finding
Unpinned Third-Party Skills Create a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Pilot Multi Region Content Sync Setup
Security checks for vulnerabilities and agentic risk
Overview
This setup skill appears purpose-aligned, but it grants broad setup authority for multi-agent trust, remote content transfer, package installation, and persistent configuration without enough scoping or confirmation.
Review this before installing in any real environment. Use only trusted Pilot peers, validate the deployment prefix to hostname-safe characters, pin or verify the companion skills before installation, confirm every local change before execution, and know how to remove ~/.pilot/setups/multi-region-content-sync.json if you no longer want the setup active.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:43- Finding
Unvalidated User-Supplied Prefix Is Interpolated into Shell Commands
- Content
View full analysis
- ``` ``` The corresponding README examples also interpolate the prefix without quoting: ```bash pilotctl set-hostname -origin pilotctl set-hostname -edge-us pilotctl set-hostname -edge-eu pilotctl set-hostname -edge-asia ``` ### Technical Analysis The procedure explicitly obtains a prefix from the user and places it into a Bash command. It does not define an allowed hostname character set, reject shell metacharacters, require argument-safe command execution, or quote the resulting value. If an agent implements this procedure through direct textual substitution and passes the resulting command to a shell, characters such as command separators or command substitutions could be interpreted as shell syntax rather than as part of a hostname. For example, a malicious prefix containing shell control syntax could turn the intended `pilotctl set-hostname` invocation into multiple commands. The issue is conditional on shell-based textual substitution; it can be prevented if the host application validates the value and invokes `pilotctl` through an argument array without a shell. ### Attack Path 1. The setup asks an untrusted user to provide a deployment prefix. 2. The user supplies a value containing shell metacharacters or command-substit ...[truncated 1031 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The trust model states that when both sides send a handshake, trust is automatically approved with no manual verification step. This reduces authentication to knowledge of agent names and a shared setup phrase, increasing the risk of misbinding, accidental trust establishment, or unauthorized pairing if naming or routing is spoofed in the environment.
- Content
2. Establish trust
Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.
bash # On edge-asia:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file instructs users to send a local file to multiple remote edge agents and publish synchronization messages, which affects remote systems and transmits content across regions. The section does not include any user-facing warning about verifying file contents, destination trust, or the fact that these commands distribute data to other hosts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs the agent to install packages, change the system hostname, and write a persistent manifest file, but it does not require an explicit confirmation or warn the user that these are local system changes. In an agentic context, this can lead to unintended configuration drift or persistent modification of the host when a user may only have been asking for guidance rather than execution.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The manifest is written to a persistent user configuration path (~/.pilot/setups/multi-region-content-sync.json), which creates lasting state on the machine beyond the current session. Persistent state is not inherently malicious here, but without disclosure and consent it can surprise users, leak environment details, or affect later runs and agent behavior.
- Content
pilotctl --json set-hostname -
text **Step 4:** Write the role-specific JSON manifest to `~/.pilot/setups/multi-region-content-sync.json`. **Step 5:** Tell the user to initiate handshakes.
Static analysis
No suspicious patterns detected.