ClawHub
Back to skill

Security audit

Pilot Relay

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Pilot Protocol relay helper, with the main caution that clearing the inbox can remove stored messages.

Install this only if you already trust pilotctl and your Pilot Protocol relay setup. Before running inbox --clear, review, export, or otherwise preserve any messages you may need for recovery or audit purposes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documented `inbox --clear` command deletes queued messages, but the skill does not clearly warn that this is a destructive operation or recommend confirming successful processing before clearing. In a store-and-forward messaging workflow, this can cause accidental message loss, audit gaps, or dropped tasks if users copy the example blindly.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.