Pilot Proposal Writer Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:16 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for setting up a proposal-writing agent network, but it deserves Review because it installs unpinned helper skills and can route sensitive proposal content to external webhook and Slack integrations without enough scoping or user confirmation.

Review this skill before installing in a business environment. Pin and verify the dependent skills, use only hostname-safe prefixes, confirm the exact webhook and Slack destinations, avoid sending confidential proposal or pricing data unless approved, and remove ~/.pilot/setups/proposal-writer.json when the deployment is no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42

Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39

Finding

Unvalidated Deployment Prefix Can Be Interpreted as Shell Syntax

Content

View full analysis

- ``` ``` Additional unquoted uses occur in `SKILL.md`, lines 160-166: ```bash # researcher and drafter handshake with each other: pilotctl --json handshake -drafter "setup: proposal-writer" pilotctl --json handshake -researcher "setup: proposal-writer" # drafter and reviewer handshake with each other: pilotctl --json handshake -reviewer "setup: proposal-writer" pilotctl --json handshake -drafter "setup: proposal-writer" ``` Equivalent patterns also appear in `README.md`, including lines 39-49 and 57-65. ### Technical Analysis The Skill directs the Agent to obtain a deployment prefix from the user and substitute it into Bash commands. The prefix is neither validated against hostname syntax nor placed in a quoted shell argument. If the Agent constructs and executes these commands through a shell, shell metacharacters embedded in the supplied prefix can change command parsing. Potentially dangerous syntax includes command separators, pipelines, redirections, command substitutions, and variable expansions. For example, a prefix containing command-substitution syntax could cause the shell to execute the embedded command before invoking `pilotctl`. A prefix containing a command separator could terminate the intended command and append another command. The issu ...[truncated 1951 chars]

Remediation

View remediation

&2 exit 1 fi ``` 2. Restrict the role to an explicit allowlist: ```bash case "$role" in researcher|drafter|reviewer) ;; *) printf '%s\n' "Invalid role" >&2 exit 1 ;; esac ``` 3. Pass all variable-derived values as quoted arguments: ```bash pilotctl --json set-hostname "${prefix}-${role}" pilotctl --json handshake "${prefix}-drafter" "setup: proposal-writer" ``` 4. Do not construct a single command string and pass it to `bash -c`, `sh -c`, or `eval`. Invoke the executable with a structured argument array whenever the Agent runtime supports it. 5. Apply the same validation and quoting rules to all handshake, subscription, and publishing commands in both `SKILL.md` and `README.md`. 6. Clearly instruct the Agent to reject prefixes containing whitespace, shell metacharacters, substitutions, path separators, or characters outside the approved hostname alphabet. 7. Add tests covering malicious values containing semicolons, pipes, redirections, backticks, `$()` substitutions, newlines, spaces, quotes, and leading hyphens. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README explicitly describes sending final proposal content to an external destination via webhook but does not warn users that sensitive proposal data, pricing, timelines, and client information may leave the private agent environment. In a proposal-writing workflow, this can lead to unintended disclosure of confidential business information if operators enable the bridge without understanding the external transmission boundary.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The trust model auto-approves communication once both sides exchange handshakes, with no manual verification step of identity or authorization described. In a multi-agent deployment that handles potentially sensitive proposal and pricing data, this lowers the barrier for misconfiguration or spoofed peer trust, which could expose internal data flows to unintended agents.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# On drafter:

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation at L90 states that the reviewer 'receives the draft and submits,' and the earlier data flow at L29 describes final proposal submission to an external destination via webhook. However, the command at L91 uses pilotctl publish <your-prefix>-reviewer final-proposal ..., which targets the reviewer agent itself rather than an external submission path, contradicting the stated behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill persists a setup manifest under ~/.pilot/setups/proposal-writer.json, creating durable local state that may include role, peer hostnames, communication topology, and workflow metadata. While this is not inherently malicious, undocumented persistence can expose operational details to other local processes or users and may outlive the user's expectations, especially in shared or managed environments.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/proposal-writer.json << 'MANIFEST'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly configures pilot-webhook-bridge and pilot-slack-bridge, and documents reviewer-to-external submission over port 443, but it does not warn the user that proposal content, pricing, client details, or other sensitive business data may be transmitted to third-party services. In a proposal-writing workflow, those documents commonly contain confidential or regulated information, so omission of a clear disclosure and consent step can lead to unintended data exfiltration or policy violations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.