Pilot Real Estate Analyzer Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:38 AM UTC
• Version: 1.0.0

Overview

The skill appears purpose-aligned, but it needs review because it installs multiple unpinned skills and sets up persistent agent trust plus external deal alerts that may expose sensitive real estate data.

Review the dependency list before installing, prefer pinned versions or verified publishers, and confirm each peer hostname before handshaking. For the notifier role, use approved Slack/email/webhook destinations and avoid sending more property, investor, valuation, or ROI detail than necessary.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:46

Finding

Unpinned Third-Party Skill Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46–55
Vulnerability Type: Unpinned third-party dependencies from an external registry
Risk Level: Medium

Vulnerable Code

bash

# scraper:
clawhub install pilot-stream-data pilot-cron pilot-archive
# analyzer:
clawhub install pilot-metrics pilot-dataset pilot-task-router
# comparator:
clawhub install pilot-event-filter pilot-share pilot-review
# notifier:
clawhub install pilot-alert pilot-slack-bridge pilot-webhook-bridge

Technical Analysis

The setup procedure directs the user to install multiple third-party Skills by package name without pinning exact versions or immutable content digests. It also provides no signature, checksum, canonical source, or publisher-verification requirement.

Consequently, the effective code installed during deployment can differ from the code originally reviewed. This creates a supply-chain risk if a named package or its publisher account is compromised, if mutable releases are replaced, or if registry name resolution returns an unintended package.

The repository does not contain the dependencies, so this audit cannot confirm that any dependency is currently malicious. The finding concerns the unsafe dependency acquisition process.

Attack Path

1. An attacker compromises a listed package, its publisher account, or the registry resolution path.
2. The attacker publishes a malicious release under one of the dependency names.
3. An operator follows the documented setup procedure and runs the unpinned clawhub install command.
4. clawhub resolves and installs the attacker-controlled release.
5. The installed Skill executes when invoked and abuses its granted tools or network access.

Impact Assessment

A compromised dependency could act with the permissions granted to the host agent and its available tools. Depending on runtime configuration, this may permit access to property, valuation, investor, or notification data; modification of l ...[truncated 316 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every Skill to an exact, reviewed version or immutable content digest.
• Verify registry signatures and package checksums before installation.
• Document the canonical publisher and source repository for each dependency.
• Review dependency contents and transitive dependencies before approving upgrades.
• Use an allowlisted internal registry or lock file where supported.
• Prevent automatic resolution to newer mutable releases.
• Grant each installed Skill only the tools, filesystem access, credentials, and network destinations required for its role.
• Test dependency updates in an isolated environment before production deployment.

T08 · Insecure Dependencies

Warning

• Location: README.md:43

Finding

Unpinned Third-Party Skill Dependencies in Deployment Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 43–59
Vulnerability Type: Unpinned third-party dependencies from an external registry
Risk Level: Medium

Vulnerable Code

bash

# On server 1 (property scraping)
clawhub install pilot-stream-data pilot-cron pilot-archive
pilotctl set-hostname <your-prefix>-scraper

# On server 2 (market analysis)
clawhub install pilot-metrics pilot-dataset pilot-task-router
pilotctl set-hostname <your-prefix>-analyzer

# On server 3 (comparable analysis)
clawhub install pilot-event-filter pilot-share pilot-review
pilotctl set-hostname <your-prefix>-comparator

# On server 4 (deal notifications)
clawhub install pilot-alert pilot-slack-bridge pilot-webhook-bridge
pilotctl set-hostname <your-prefix>-notifier

Technical Analysis

The public deployment instructions repeat the unpinned installation of external Skills. Operators following this documentation receive whatever versions the registry resolves at installation time, rather than known, reviewed artifacts. No integrity validation or publisher verification is prescribed.

This is a separate documentation location for the same underlying supply-chain weakness. There is no evidence in the reviewed project that the named dependencies are currently malicious.

Attack Path

1. An attacker gains control of a listed package release, publisher account, or relevant registry path.
2. A malicious or modified version is made available under the expected package name.
3. An operator copies the documented installation commands on one or more servers.
4. The package manager installs the malicious version because no version or digest is pinned.
5. The dependency later executes with the capabilities available to its assigned agent role.

Impact Assessment

Successful exploitation could compromise one or more pipeline roles: scraper, analyzer, comparator, or notifier. Potential effects include unauthorized access to workflow data, alteration of analysis ...[truncated 317 chars]

Remediation

View remediation

Remediation Suggestions

• Replace package-name-only installation commands with exact versions or immutable digests.
• Publish and enforce a reviewed dependency lock manifest.
• Require cryptographic signature and checksum verification.
• Identify trusted publishers and canonical source repositories in the documentation.
• Use an approved package mirror or registry allowlist.
• Review and stage all dependency upgrades before rollout.
• Apply least-privilege restrictions separately to each agent role.
• Restrict outbound network access to explicitly required peers and notification endpoints.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly routes deal alerts to Slack, email, and webhook destinations but does not warn that property, valuation, investor preference, and ROI data may be sent to third-party services. In a real estate investment workflow, this can expose commercially sensitive information or personal data if notifications are misconfigured, shared too broadly, or sent to external SaaS platforms without review.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The trust model auto-approves communication once both sides exchange handshakes, with no manual verification of identity or authorization. If an operator handshakes with the wrong host, a spoofed host, or a compromised agent using a similar prefix, the system may establish trusted channels that allow unauthorized data exchange across the pipeline.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# On scraper:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The skill explicitly instructs writing a persistent manifest into the user's home directory, causing session state to survive beyond the current interaction. In an agent setting, session persistence can be risky because later runs may trust or consume this stored configuration without the user's ongoing awareness, enabling stale, unintended, or attacker-influenced state to affect future behavior.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/real-estate-analyzer.json << 'MANIFEST'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The notifier role is designed to send deal alerts and potentially property-related analysis to external Slack, email, and webhook endpoints, but the skill provides no warning about data leaving the local agent environment. This omission increases the risk of unintended disclosure, misdelivery, or tampering if sensitive investor, property, or scoring data is forwarded to third-party services without operator awareness and validation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to create and overwrite a persistent file under ~/.pilot/setups, which changes local configuration state across sessions. Even though this appears to be standard setup behavior, the instructions do not require explicit user confirmation or warn that a local manifest will be persisted, creating a transparency and integrity risk if run automatically or in the wrong context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.