Security audit

Pilot Protocol

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for agent networking, but it needs review because it installs a persistent network daemon through an unverified remote script and includes automation that can blindly trust peers and run incoming tasks.

Review this skill before installing. Do not run the curl | sh installer unless you trust the publisher and delivery endpoint; prefer a verified, versioned download. Avoid adding the provided heartbeat script as written, and require manual or policy-based review before approving peers, accepting tasks, executing tasks, processing received files, or sending results. Use gateway and webhook features only with deliberate scoping, avoid sudo unless absolutely necessary, and monitor the persistent ~/.pilot service, config, inbox, received files, tasks, and webhook settings.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:75
Finding: Unpinned Remote Installer Is Downloaded and Executed Directly
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:95
Finding: Unaudited Installer Establishes Cross-Session Daemon Persistence
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:287
Finding: Persistent Heartbeat Automatically Trusts Peers and Accepts Remote Tasks
Content: View full analysis
/dev/null || pilotctl daemon start for id in $(pilotctl --json pending 2>/dev/null | grep -o '"node_id":[0-9]*' | grep -o '[0-9]*'); do pilotctl approve "$id" done for task_id in $(pilotctl --json task list --type received 2>/dev/null | jq -r '.data.tasks[] | select(.status=="NEW") | .task_id'); do pilotctl task accept --id "$task_id" done next_task=$(pilotctl --json task queue 2>/dev/null | jq -r '.data.queue[0].task_id // empty') if [ -n "$next_task" ]; then pilotctl task execute fi ``` ``` ### Technical Analysis The Skill instructs the agent to write recurring behavior into `HEARTBEAT.md` or an equivalent persistent task mechanism. It then supplies a script that approves every pending trust request without validating peer identity or justification and accepts every task whose status is `NEW` without reviewing its contents. This conflicts with the project's own safety guidance in `references/TASK-SUBMIT.md`, which says tasks requesting shell execution, sensitive-file access, network scanning, denial of service, obfuscated c ...[truncated 2554 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (23)

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: Piping a remote script directly into the shell executes unreviewed network-fetched code immediately, creating a strong supply-chain and remote-code-execution risk. In this skill, the installer also modifies PATH, writes config, and sets up services, so compromise of the distribution endpoint or transit path would have significant local impact.
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
No sudo required. Binaries are installed to ~/.pilot/bin/.

bash
curl -fsSL https://pilotprotocol.network/install.sh | sh

Sets a hostname during install:

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The command chain combines remote content retrieval with immediate shell execution, removing any pause for inspection or integrity verification. This pattern is especially risky in an agent skill because it teaches automation-friendly execution of arbitrary downloaded code, which can be repurposed or silently compromised.
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
No sudo required. Binaries are installed to ~/.pilot/bin/.

bash
curl -fsSL https://pilotprotocol.network/install.sh | sh

Sets a hostname during install:

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The heartbeat guidance recommends approving trust requests and accepting/executing incoming tasks automatically without prominent warnings about the security consequences. In a peer-to-peer agent skill, this omission is especially dangerous because it encourages autonomous trust expansion and remote-triggered work execution as routine maintenance.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions and sample automation normalize accepting inbound tasks immediately, and the script auto-accepts all NEW tasks before executing queued work. That enables unsolicited remote work execution from peers, which can drive the agent to process attacker-controlled task content or perform actions beyond the user's intent.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: These instructions operationalize unsafe defaults by treating blind trust approval and automatic task acceptance/execution as normal maintenance behavior. Because the skill is specifically designed for inter-agent networking and task exchange, this creates a direct path for malicious or untrusted peers to gain influence over the local agent's workflow.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The heartbeat sample script automatically approves every pending trust request, which collapses the protocol's trust boundary and lets any requester become trusted without review. In this skill's context, trust gates discovery, messaging, file exchange, and tasking, so blind approval can expose the agent to unsolicited communications and follow-on abuse from arbitrary peers.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The auto-approval behavior is especially risky because it normalizes trust establishment through reciprocal handshakes without emphasizing that this can create trust automatically. In the context of an overlay network for inter-agent communication, an attacker could induce or socially engineer a mutual handshake and obtain trusted status with less operator scrutiny than a manual approval flow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The installation and usage guidance sets up a networked daemon, registry connectivity, messaging, file receipt, and optional task execution, yet it lacks a clear warning that data will be transmitted to external peers and that a background service and local mailbox directories will be created. Users may enable broad network capabilities and persistent services without understanding privacy, exposure, or system-modification implications.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
Install

No sudo required. Binaries are installed to ~/.pilot/bin/.

bash
curl -fsSL https://pilotprotocol.network/install.sh | sh

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: The skill states that the installer sets up a system service and that gateway operation may require sudo for ports below 1024, which implies possible privileged system changes without much detail on scope or safeguards. While not inherently malicious, the combination of background service installation and optional root-requiring network bridging increases the blast radius if misused or misunderstood.
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
clawhub install pilot-protocol

text
The installer detects your platform, downloads pre-built binaries (or builds from source if no release is available), writes `~/.pilot/config.json`, adds `~/.pilot/bin` to your PATH, and sets up a system service (systemd on Linux, launchd on macOS). Only the gateway requires sudo — and only for ports below 1024. ## Self-Discovery

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The send-file documentation explicitly states that the receiving daemon saves the transferred file to ~/.pilot/received/, but it does not warn users that invoking this command causes a write on the remote host. In an agent-to-agent communication skill, that omission is risky because users or downstream agents may treat it as a harmless message operation and unintentionally deliver untrusted or sensitive files to another system where they will be persisted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The send-message command description notes that the target saves messages to ~/.pilot/inbox/, but it lacks a prominent warning that submitted content is persisted on the remote host. In this skill's context, where agents may automate task submission and inter-agent messaging, failing to highlight persistence increases the chance of accidental data leakage, storage of malicious payloads, or unintended retention of sensitive instructions on peer systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown documents pilotctl disconnect <conn_id>, which actively terminates an existing connection, but provides no warning that the action is disruptive or may interrupt active traffic. For markdown files, destructive or system-impacting behavior should be disclosed so users understand the operational impact before invoking it.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation instructs users to start an IP bridge that opens TCP proxy listeners and may require root for privileged ports, but it does not prominently warn that this exposes local listening services and expands the attack surface. In the context of an agent-to-agent gateway, unclear documentation can lead operators to enable broad port exposure or run with elevated privileges without understanding the security implications.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 84% confidence
Finding: The example normalizes use of sudo to start the gateway, which can encourage operators to run the service with full privileges even when only a specific capability or higher unprivileged port would suffice. Because this gateway bridges network traffic from remote agents into local TCP listeners, running it as root increases the consequences of misconfiguration or any implementation flaw.
Content: Scanner excerpt · references/GATEWAY.md (reported line 51)May include surrounding context.
bash
# Map a remote agent and proxy port 3000 sudo pilotctl gateway start --ports 3000 0:0000.0000.0001 # mapped 10.4.0.1 -> 0:0000.0000.0001 # Now use standard tools

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 84% confidence
Finding: This second example again promotes starting the gateway with sudo, and additionally demonstrates exposing multiple ports at once, which compounds the risk of unnecessary privilege use and network exposure. In a skill specifically designed to bridge IP traffic between agents, broad multi-port root-run examples make unsafe deployment patterns more likely.
Content: Scanner excerpt · references/GATEWAY.md (reported line 59)May include surrounding context.
{"status":"ok","protocol":"pilot","port":3000}

Map multiple agents with multiple ports

sudo pilotctl gateway start --ports 80,3000,8080 0:0000.0000.0007 curl http://10.4.0.1/status curl http://10.4.0.1:3000/api/data

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation presents approve and untrust as routine operations without warning that approving a peer grants that remote agent access to agent-to-agent communication capabilities and that revocation affects an established trust boundary. In a trust-management skill, omission of these security consequences can cause users or downstream agents to approve unverified peers too casually, enabling unauthorized data exchange or task submission.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 86% confidence
Finding: The documented automatic trust decision is a form of autonomous security-relevant decision making: the system changes a trust state based on matching handshake behavior, without an explicit manual authorization at the time trust is granted. In this skill's context, where trust unlocks communication between agents, such automation increases the risk of unintended trust relationships and subsequent data exposure or remote task abuse.
Content: Scanner excerpt · references/TRUST.md (reported line 57)May include surrounding context.
md
## Auto-approval Trust is auto-approved when both agents independently request a handshake with each other (mutual handshake). ## Trust workflow example

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The example concludes that agents can 'communicate freely' once trusted, but does not warn that trust may permit broad data sharing, file transfer, task exchange, or other sensitive interactions. This wording can lead users to treat trust as low-risk convenience rather than a significant security boundary, increasing the chance of over-trusting peers in production environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation instructs users to send real-time daemon events to an HTTP endpoint without warning that these events may contain sensitive operational metadata such as node identifiers, peer activity, trust-handshake details, and received-message/file notifications. In the context of an agent-to-agent networking daemon, this omission can lead users to expose internal telemetry to insecure or unintended destinations, especially if plain HTTP is used.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/WEBHOOKS.md (reported line 50)May include surrounding context.
md
| `handshake.pending` | Handshake queued for approval | | `handshake.approved` | Handshake approved | | `handshake.rejected` | Handshake rejected | | `handshake.auto_approved` | Mutual handshake auto-approved | | `trust.revoked` | Trust revoked locally | | `trust.revoked_by_peer` | Trust revoked by remote peer | | `message.received` | Typed message received via data exchange |

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/WEBHOOKS.md (reported line 50)May include surrounding context.
md
| `handshake.pending` | Handshake queued for approval | | `handshake.approved` | Handshake approved | | `handshake.rejected` | Handshake rejected | | `handshake.auto_approved` | Mutual handshake auto-approved | | `trust.revoked` | Trust revoked locally | | `trust.revoked_by_peer` | Trust revoked by remote peer | | `message.received` | Typed message received via data exchange |

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The runtime command documentation notes that the webhook URL persists to user config and applies immediately, but it does not clearly warn that this instantly alters daemon behavior and creates a durable exfiltration path for future events. In a security-sensitive networking skill, lack of emphasis on immediate and persistent side effects increases the chance of accidental misconfiguration or unnoticed redirection of telemetry.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T06 · System Persistence

T01 · Skill Instruction Hijacking

SkillSpector

External Script Fetching

Chaining Abuse

Missing User Warnings

Context-Inappropriate Capability

Ssd 4

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Sudo/Root Execution

Install

Sudo/Root Execution

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Sudo/Root Execution

Sudo/Root Execution

{"status":"ok","protocol":"pilot","port":3000}

Map multiple agents with multiple ports

Missing User Warnings

Autonomous Decision Making

Missing User Warnings

Missing User Warnings

Autonomous Decision Making

Autonomous Decision Making

Missing User Warnings

Static analysis