Pilot Recruitment Pipeline Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:01 AM UTC
• Version: 1.0.0

Overview

The recruitment setup is coherent, but it uses broad shell-based setup steps, mutable third-party installs, and sensitive candidate-data flows without enough scoping or warnings.

Review this before installing in any real hiring environment. Use only approved and pinned dependency skills, restrict prefixes to safe hostname characters, verify peer identities before handshakes, and confirm what applicant data may be sent to other agents, Slack, calendar APIs, or webhooks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49

Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:49-55; duplicated in README.md:38-49
Vulnerability Type: Unpinned third-party dependencies from an external registry
Risk Level: Medium

The setup procedure installs nine third-party skills by name without specifying immutable versions, content hashes, signatures, or an approved source.

bash

# For sourcer:
clawhub install pilot-discover pilot-stream-data pilot-metrics
# For screener:
clawhub install pilot-event-filter pilot-task-router pilot-alert
# For scheduler:
clawhub install pilot-webhook-bridge pilot-slack-bridge pilot-receipt

Technical Analysis

The installed skills are resolved dynamically through clawhub. Because no version constraints or integrity values are provided, the effective code installed during deployment can change after this project has been reviewed.

The source code of these dependencies is not included in the audited project, so their behavior cannot be verified by this audit. A registry compromise, maintainer-account compromise, malicious package update, dependency confusion issue, or package-name takeover could cause a deployment to install code different from the code originally intended.

This project grants the Bash tool to the Skill and directs agents to use the installed packages in a pipeline that processes recruitment and candidate information. Consequently, a compromised dependency could potentially execute commands with the invoking agent's operating-system permissions and access data available to that agent.

Attack Path

1. An attacker compromises a maintainer account, registry entry, distribution channel, or similarly named dependency.
2. The attacker publishes a malicious or backdoored release under one of the dependency names used by the setup instructions.
3. An administrator or agent follows the setup procedure and executes the unpinned clawhub install command.
4. clawhub resolves the curren ...[truncated 1110 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every dependency to a reviewed, immutable version or content digest.
• Verify package signatures and cryptographic hashes before installation.
• Resolve packages exclusively from an approved registry or internal mirror.
• Audit each dependency and its transitive dependencies before deployment.
• Maintain an allowlist containing approved package names, publishers, versions, and hashes.
• Run installed skills with the minimum required operating-system and agent permissions.
• Isolate each pipeline role using separate service accounts, containers, or equivalent sandboxing.
• Add a deployment step that fails closed when a signature, version, publisher, or digest does not match the approved manifest.
• Monitor dependency releases and repeat the security review before accepting updates.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:46

Finding

Unvalidated Prefix Interpolation Can Cause Shell Command Injection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:46-60, with additional unsafe substitutions at SKILL.md:151-170 and README.md:34-89
Vulnerability Type: Shell command injection through an unvalidated and unquoted user-controlled prefix
Risk Level: High

The Skill explicitly asks the user to supply a prefix and then places that value into unquoted shell argument positions.

markdown

**Step 1:** Ask the user which role this agent should play and what prefix to use.

**Step 2:** Install the skills for the chosen role:
```bash
# For sourcer:
clawhub install pilot-discover pilot-stream-data pilot-metrics
# For screener:
clawhub install pilot-event-filter pilot-task-router pilot-alert
# For scheduler:
clawhub install pilot-webhook-bridge pilot-slack-bridge pilot-receipt

Step 3: Set the hostname:

bash

pilotctl --json set-hostname <prefix>-<role>

text

The same pattern is subsequently used in handshake, subscription, and publication commands:

```bash
pilotctl --json handshake <prefix>-screener "setup: recruitment-pipeline"
pilotctl --json handshake <prefix>-sourcer "setup: recruitment-pipeline"
pilotctl --json handshake <prefix>-scheduler "setup: recruitment-pipeline"

pilotctl --json subscribe <prefix>-sourcer candidate-profile
pilotctl --json subscribe <prefix>-screener screened-candidate
pilotctl --json publish <prefix>-screener candidate-profile '{"candidate":"Jane Doe","role":"Senior Backend Engineer","match_score":92,"source":"linkedin"}'
pilotctl --json publish <prefix>-scheduler screened-candidate '{"candidate":"Jane Doe","screen_score":88,"red_flags":[],"recommendation":"interview"}'

Technical Analysis

The documentation does not define or enforce a permitted hostname grammar for prefix. It also does not require the generated command to be executed through an argument-vector API that bypasses shell ...[truncated 2318 chars]

Remediation

View remediation

Remediation Suggestions

• Validate the prefix before generating or executing any command.
• Restrict prefixes to a hostname-safe grammar, for example: ^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$
• Reject whitespace, shell metacharacters, control characters, path separators, Unicode lookalikes, and values outside the permitted length.
• Enforce an explicit role allowlist containing only sourcer, screener, and scheduler.
• Invoke pilotctl through a structured process API with a separate argument array instead of constructing a shell command string.
• If Bash cannot be avoided, pass validated values as positional parameters and quote every expansion; do not use eval.
• Validate the final generated hostname against the platform's hostname rules and length limits.
• Display the normalized hostname to the user and request confirmation before changing configuration or establishing trust.
• Apply the same validation and safe argument handling to every hostname occurrence in setup, handshake, subscribe, and publish operations.
• Add automated tests using malicious prefixes containing semicolons, command substitutions, pipes, redirects, quotes, newlines, and leading option characters.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README instructs users to automate sourcing, screening, and scheduling using identifiable candidate data, but it does not warn that resumes, match scores, red flags, and interview details are sensitive personal data. In a hiring workflow, silent transmission of this data between agents and onward to external systems can create privacy, compliance, and data-minimization risks if operators deploy it without appropriate consent, retention, or access controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented data flow sends interview invites to an external calendar API, which likely includes candidate names, interview times, and related metadata, but the README does not explicitly warn that third-party services will receive applicant information. This omission is risky because users may unknowingly expose regulated HR data to external processors without vendor review, privacy notices, or contractual safeguards.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The trust model auto-approves communication once both sides exchange handshakes, with no documented human verification of identity, out-of-band confirmation, or approval gate. In a multi-agent pipeline handling sensitive candidate data, this can enable accidental trust establishment with the wrong host or a spoofed agent, leading to unauthorized data sharing and downstream abuse.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# On sourcer:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill persists a recruitment-pipeline manifest under ~/.pilot/setups, creating session/state persistence on disk. While persistence is often legitimate for setup automation, in this context the manifest stores role topology, peer hostnames, and data-flow configuration for a system handling candidate data, which can expose operational metadata or be reused later without fresh user review.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/recruitment-pipeline.json << 'MANIFEST'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly describes sending candidate and interview data between agents and from the scheduler to an external calendar API/webhook, but it provides no user-facing warning about external transmission of potentially sensitive personal data. In a recruitment context this is materially risky because resumes, names, scores, and scheduling details are likely personal data subject to privacy, consent, and retention requirements.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.