Pilot Release Management Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:16 AM UTC
• Version: 1.0.0

Overview

This release setup is coherent but deserves review because it installs unpinned agent skills, creates persistent local setup state, auto-establishes agent trust, and can send release data to external services.

Install only after reviewing the named dependency skills and pinning approved versions where possible. Use a simple hostname-safe prefix, review ~/.pilot/setups/release-management.json before writing it, verify peer identities before handshakes, and limit Slack/webhook/email destinations to approved release channels with non-sensitive release content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45

Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

-changelog-bot # On server 2 (version manager) clawhub install pilot-task-router pilot-receipt pilot-audit-log pilotctl set-hostname -version-manager # On server 3 (release announcer) clawhub install pilot-announce pilot-slack-bridge pilot-webhook-bridge pilotctl set-hostname -announcer ``` ### Technical Analysis Dependency names without immutable version or integrity constraints are resolved according to the current state of the configured `clawhub` registry. Consequently, the installed implementation can change after this project has been reviewed. The source code of these dependencies is not included in the audited project, so their behavior and integrity cannot be verified from the repository. If a package publisher account, registry, name-resolution mechanism, or upstream release is compromised, setup can install attacker-controlled Skill content. The risk is especially significant because the project grants the installed Skills access to release metadata, GitHub integration, Slack, webhooks, task routing, and local agent tools. ### Attack Path 1. An attack ...[truncated 1539 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:56

Finding

Unvalidated Prefix Is Interpolated into Shell Commands

Content

View full analysis

- ``` `SKILL.md:157-163`: ```bash # changelog-bot and version-manager handshake with each other: pilotctl --json handshake -version-manager "setup: release-management" pilotctl --json handshake -changelog-bot "setup: release-management" # version-manager and announcer handshake with each other: pilotctl --json handshake -announcer "setup: release-management" pilotctl --json handshake -version-manager "setup: release-management" ``` Corresponding examples in `README.md:40-48` include: ```bash # On server 1 (changelog bot) clawhub install pilot-github-bridge pilot-share pilot-archive pilotctl set-hostname -changelog-bot # On server 2 (version manager) clawhub install pilot-task-router pilot-receipt pilot-audit-log pilotctl set-hostname -version-manager # On server 3 (release announcer) clawhub install pilot-announce pilot-slack-bridge pilot-webhook-bridge pilotctl set-hostname -announcer ``` ### Technical Analysis Shell command injection occurs when untrusted input is incorporated into command text and interpreted by a shell without strict validation or safe argument handling. Here, the prefix is explicitly user-selected, while the templates show direct textual substitution into Bash commands. If an agent or operator replaces the placeholder verbatim with a value containing shell control syntax, such as command separators or comma ...[truncated 1986 chars]

Remediation

View remediation

&2 exit 1 fi ``` 2. Validate the role against an explicit enumeration: ```bash case "$role" in changelog-bot|version-manager|announcer) ;; *) printf '%s\n' "Invalid role" >&2; exit 1 ;; esac ``` 3. Quote every expanded argument: ```bash pilotctl --json set-hostname "${prefix}-${role}" pilotctl --json handshake "${prefix}-version-manager" "setup: release-management" ``` 4. When implementing setup programmatically, invoke commands through an argument array or direct process API rather than constructing a shell command string. 5. Reject whitespace, shell metacharacters, command substitutions, path separators, leading hyphens, and Unicode characters outside the documented hostname policy. 6. Apply identical validation and quoting to hostname, handshake, subscribe, and publish commands in both `SKILL.md` and `README.md`. 7. Add tests covering malicious values containing separators, substitutions, whitespace, redirection operators, and option-like prefixes. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly describes automatic release announcements to Slack, email, and documentation sites but does not warn that release metadata may be transmitted to third-party systems. In a release-management context, changelogs, version tags, migration notes, or artifact references can contain sensitive internal details, so silent external propagation creates a real disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The data-flow section normalizes outbound announcements to external systems over Slack and webhooks without any caution about external transmission or data sensitivity. Because this skill is designed to automate publishing, users may enable it assuming internal-only flow, increasing the chance of unintentionally exposing pre-release or internal operational information.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The trust model states that once both sides send a handshake, trust is auto-approved with no manual review. This reduces human verification for establishing inter-agent trust, so a misaddressed handshake, compromised host, or unauthorized agent using the expected naming convention could gain a trusted communication path and influence release operations.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# On version-manager:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The skill directs the agent/user to persist a manifest in ~/.pilot/setups, creating durable local state that can influence future agent behavior. Even though this is aligned with setup functionality, session-persistent state increases risk because it survives the current interaction, may be reused implicitly later, and could be abused if the manifest contents are modified or generated from untrusted input.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/release-management.json << 'MANIFEST'

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

In this markdown file, Step 4 instructs the agent to create a directory and write a JSON manifest into the user's home directory. The surrounding description does not explicitly warn that local configuration files will be created or overwritten, which is a user-impacting filesystem change.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.