ClawHub
Back to skill

Security audit

Pilot Podcast Production Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill fits a podcast automation setup, but it gives agents persistent configuration, trust setup, mutable installs, and external publishing paths without enough safeguards.

Review this before installing. Use only test publishing credentials and non-public destinations until the workflow is verified, validate the deployment prefix with a strict hostname-safe pattern, pin and verify every installed skill, inspect existing ~/.pilot/setups state before writing, and manually confirm all trust relationships and external publishing targets.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:45
Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:45-52; duplicated in README.md:42-52
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:45-52:

bash
# For researcher:
clawhub install pilot-discover pilot-stream-data pilot-archive

# For producer:
clawhub install pilot-task-router pilot-share pilot-cron

# For distributor:
clawhub install pilot-webhook-bridge pilot-announce pilot-slack-bridge

Equivalent installation instructions appear in README.md:42-52:

bash
# On server 1 (topic researcher)
clawhub install pilot-discover pilot-stream-data pilot-archive
pilotctl set-hostname <your-prefix>-researcher

# On server 2 (episode producer)
clawhub install pilot-task-router pilot-share pilot-cron
pilotctl set-hostname <your-prefix>-producer

# On server 3 (content distributor)
clawhub install pilot-webhook-bridge pilot-announce pilot-slack-bridge
pilotctl set-hostname <your-prefix>-distributor

Technical Analysis

The setup procedure installs nine third-party skills by mutable package name without specifying exact versions, immutable content hashes, trusted source locations, or signature-verification requirements. Consequently, the dependency content retrieved during deployment may differ from the content that was originally reviewed.

The affected dependencies include components intended to process streamed data, archives, scheduled tasks, file sharing, webhooks, announcements, and Slack communication. If any named package or its publishing account is compromised, a later installation could introduce unauthorized behavior into the podcast agents.

The repository itself does not contain evidence that these dependencies are currently malicious. The vulnerability is the absence of controls that bind installation to reviewed dependency artifacts.

Attack Path

  1. An attacker compromi ...[truncated 1370 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every dependency to an exact, reviewed version or immutable content digest.
  2. Require cryptographic signature verification and document the expected publisher identity for each skill.
  3. Record approved hashes in a lock file or deployment manifest and reject artifacts that do not match them.
  4. Use an allowlisted registry or internally mirrored repository rather than accepting packages from unspecified sources.
  5. Audit the source and transitive dependencies of all nine skills before deployment.
  6. Run installed skills with least privilege, limiting filesystem, network, credential, webhook, and messaging access to what each role requires.
  7. Establish a controlled dependency-update process that includes review, integrity validation, testing, and explicit approval before changing pinned versions.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:42
Finding

Shell Command Injection Through an Unvalidated Deployment Prefix

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:42,55-57,145-151,158-169; duplicated in README.md:38,45-52,61-71,81-92
Vulnerability Type: Shell command injection through unquoted user-controlled input
Risk Level: High

Vulnerable Code

SKILL.md:42,55-57 instructs the agent to obtain a prefix from the user and substitute it into a Bash command without quoting or validation:

markdown
**Step 1:** Ask the user which role this agent should play and what prefix to use.

**Step 3:** Set the hostname:
```bash
pilotctl --json set-hostname <prefix>-<role>
text

The same unquoted substitution pattern is used in `SKILL.md:145-151`:

```bash
# researcher and producer handshake with each other:
pilotctl --json handshake <prefix>-producer "setup: podcast-production"
pilotctl --json handshake <prefix>-researcher "setup: podcast-production"

# producer and distributor handshake with each other:
pilotctl --json handshake <prefix>-distributor "setup: podcast-production"
pilotctl --json handshake <prefix>-producer "setup: podcast-production"

It is also used in workflow commands at SKILL.md:158-169:

bash
# On producer -- subscribe to episode briefs:
pilotctl --json subscribe <prefix>-researcher episode-brief

# On distributor -- subscribe to episode packages:
pilotctl --json subscribe <prefix>-producer episode-package

# On researcher -- publish an episode brief:
pilotctl --json publish <prefix>-producer episode-brief '{"topic":"Future of AI Agents","guests":["Jane Smith"],"talking_points":["autonomous deployments","agent collaboration"]}'

# On producer -- publish episode package to distributor:
pilotctl --json publish <prefix>-distributor episode-package '{"title":"EP42: Future of AI Agents","duration_minutes":45,"show_notes":"Deep dive into autonomous deployments.","timestamps":["00:00 Intro","12:30 Main topic","40:00 
...[truncated 2446 chars]
Remediation
View remediation

Remediation Suggestions

  1. Validate the prefix before using it. Apply a strict hostname-label allowlist, such as lowercase ASCII letters, digits, and internal hyphens, with an appropriate length limit.
  2. Reject prefixes containing whitespace, shell metacharacters, substitutions, path separators, control characters, or leading/trailing hyphens.
  3. Validate the selected role against a fixed enumeration: researcher, producer, or distributor.
  4. Do not construct executable shell command strings from user-controlled input. Invoke pilotctl directly with an argument array through a process-execution API.
  5. If shell execution is unavoidable, apply robust shell escaping to every substituted argument after validation. Do not rely on escaping alone to enforce hostname semantics.
  6. Store the validated prefix once and use only that canonical value for hostname, handshake, subscription, publication, and manifest generation.
  7. Add negative tests covering command separators, command substitution, pipes, redirection, whitespace, newlines, Unicode confusables, overlong labels, and leading or trailing hyphens.
  8. Update both SKILL.md and README.md so the secure requirements are consistent across operational and user-facing instructions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill explicitly describes publishing episodes to RSS, podcast platforms, and social media, but it does not warn operators that these actions send content to external third-party systems and may expose internal drafts, incorrect metadata, or sensitive information. In an automation-focused setup advertised as requiring minimal human intervention, omission of an external-publication warning materially increases the risk of unintended disclosure.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The trust model states that once both sides send a handshake, trust is auto-approved with no manual review, which reduces human verification for establishing inter-agent communication. If an operator mistypes a target, reuses a predictable prefix, or an unauthorized agent can participate in the handshake flow, the system may grant trusted communication too easily and enable unintended data sharing or action chaining.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash
# researcher <-> producer

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example command actively demonstrates sending a publish-notification to external channels and platforms without any caution that this can trigger real-world publication or audience-facing notifications. Because users often copy-paste README examples directly, this creates a concrete risk of accidental, irreversible posting to production destinations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill persists setup state by writing a manifest into ~/.pilot/setups, creating session-to-session behavior that survives the immediate task. Persistent agent state can be risky when users do not expect it, because later workflows may implicitly trust or reuse the saved configuration, including peer hostnames and data-flow assumptions.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/podcast-production.json << 'MANIFEST'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The distributor role is explicitly designed to send data to external services via webhooks, RSS/platform publication, and Slack posting, but the skill does not clearly warn the user that content will leave the local multi-agent environment. In a production workflow, this omission increases the risk of unintended disclosure of unpublished episode content, metadata, or internal notes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs the agent to create and overwrite a persistent file under ~/.pilot/setups and to change local agent configuration without explicitly warning the user that it will modify state on disk. This is not overtly malicious, but it can surprise users, create unintended persistent configuration, and make rollback harder if the setup is run in the wrong environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.