Pilot Newsletter Automation Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:16 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent newsletter automation setup, but it deserves review because it can lead to real bulk email dispatch and installs/runs unpinned components with weak input-safety guidance.

Before installing, treat this as a production email workflow: use test recipients first, verify the mailer cannot contact real subscriber lists until approved, pin and verify every dependency, choose a simple hostname prefix containing only letters, numbers, underscores, or hyphens, and review the local ~/.pilot setup file permissions and cleanup process.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49

Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

-curator # On server 2 (newsletter writer) clawhub install pilot-task-router pilot-share pilot-receipt pilotctl set-hostname -writer # On server 3 (email dispatcher) clawhub install pilot-webhook-bridge pilot-announce pilot-metrics pilotctl set-hostname -mailer ``` ### Technical Analysis The setup installs nine external skills solely by package name. It does not specify immutable versions, package digests, verified publisher identities, signatures, or an explicitly trusted registry endpoint. Consequently, the code installed during setup can differ from the code originally reviewed. This creates exposure to package compromise, malicious updates, namespace takeover, dependency confusion, or registry-level substitution. The contents of these dependencies are not included in the audited project, so their behavior cannot be verified from the available files. This issue is especially significant because the skill declares Bash as an allowed tool. A malicious installed skill may therefore be able to influence an agent that has local command-execution capability. ### Attack Path 1. An attacker compromises a publisher account, registry entry, or distribution infrastructure for one of the named skills. 2. The attacker publishes a malicious release under ...[truncated 1283 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:43

Finding

Unvalidated User-Controlled Prefix Is Interpolated into Shell Commands

Content

View full analysis

- ``` ``` The same unvalidated value is used in handshake commands: ```bash # curator and writer handshake with each other: pilotctl --json handshake -writer "setup: newsletter-automation" pilotctl --json handshake -curator "setup: newsletter-automation" # writer and mailer handshake with each other: pilotctl --json handshake -mailer "setup: newsletter-automation" pilotctl --json handshake -writer "setup: newsletter-automation" ``` ### Technical Analysis The instructions direct the agent to obtain a prefix from the user and substitute it into commands executed through Bash. No syntax validation, character allowlist, maximum length, escaping requirement, or safe argument-passing mechanism is specified. If an implementation performs direct textual substitution, shell metacharacters contained in the prefix can terminate or modify the intended command. Characters and constructs such as semicolons, command substitutions, redirection operators, pipes, or newlines may be interpreted by the shell rather than treated as hostname data. For example, a prefix conceptually ...[truncated 2083 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly promises automated newsletter dispatch to subscriber segments without any safety notice, confirmation step, or warning that real outbound email may be sent. In an automation skill focused on production workflows, this increases the likelihood that a user will trigger bulk messaging unintentionally, causing spam, reputational harm, or policy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The data flow section shows mailer output to an external destination over port 443 but provides no warning that this step may result in real-world email delivery. Because this is setup documentation, omission of that warning can normalize direct production dispatch and lead operators to connect live systems before validating content, recipients, or authorization.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The trust model auto-approves communication once both sides exchange handshakes, removing any manual verification step. If hostnames are mis-typed, spoofed, or exchanged with an unintended peer, the system may establish trusted data flows automatically, which is especially risky in a pipeline that can ultimately dispatch external email.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# On writer:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The try-it example includes an email-dispatch publish action with a realistic subscriber segment and recipient count, but no warning that it may queue or initiate actual deliveries. Executable examples in setup docs are especially risky because users commonly copy-paste them, making accidental bulk sends more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill sets up a mailer role that explicitly sends newsletter content to external systems via webhooks and subscriber email dispatch, but it does not warn the operator that curated content, drafts, and potentially subscriber-related data will leave the local agent environment. This omission can cause users to enable external transmission without informed consent, increasing privacy, compliance, and data-handling risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The setup writes a persistent manifest into ~/.pilot/setups/newsletter-automation.json, storing role, hostname, peers, communication topology, and workflow metadata on disk. Persistent storage of operational configuration can expose internal system relationships and facilitate later misuse if the host is shared, compromised, or the file permissions are too broad.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/newsletter-automation.json << 'MANIFEST'

Static analysis

No suspicious patterns detected.