ClawHub
Back to skill

Security audit

Pilot Sales Pipeline Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent sales-pipeline purpose, but it needs review because it installs multiple unpinned automation skills and uses user-provided prefixes in shell commands without validation while handling lead, email, and CRM data.

Review before installing. Use only a simple allowlisted deployment prefix, verify each dependency and publisher before running clawhub install, confirm peer identities before handshakes, and scope CRM, email, Slack, and webhook credentials to the minimum needed. Expect a persistent ~/.pilot setup file and remove it when the deployment is no longer wanted.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:37
Finding

Shell Command Injection Through an Unvalidated Deployment Prefix

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md, lines 37-52 and 123-134
  • README.md, lines 40-55, 65-75, and 85-110

Vulnerability Type: User-controlled input interpolated into shell commands without validation or quoting
Risk Level: High

Affected code from SKILL.md:

bash
**Step 1:** Ask the user which role this agent should play and what prefix to use.

**Step 2:** Install the skills for the chosen role:
```bash
# prospector:
clawhub install pilot-discover pilot-stream-data pilot-metrics
# qualifier:
clawhub install pilot-event-filter pilot-task-router pilot-dataset
# outreach:
clawhub install pilot-email-bridge pilot-cron pilot-receipt
# crm-sync:
clawhub install pilot-webhook-bridge pilot-audit-log pilot-slack-bridge

Step 3: Set the hostname:

bash
pilotctl --json set-hostname <prefix>-<role>
text

```bash
# prospector <-> qualifier:
pilotctl --json handshake <prefix>-qualifier "setup: sales-pipeline"
pilotctl --json handshake <prefix>-prospector "setup: sales-pipeline"
# qualifier <-> outreach:
pilotctl --json handshake <prefix>-outreach "setup: sales-pipeline"
pilotctl --json handshake <prefix>-qualifier "setup: sales-pipeline"
# outreach <-> crm-sync:
pilotctl --json handshake <prefix>-crm-sync "setup: sales-pipeline"
pilotctl --json handshake <prefix>-outreach "setup: sales-pipeline"

Affected code from README.md:

bash
# On server 1 (lead prospecting)
clawhub install pilot-discover pilot-stream-data pilot-metrics
pilotctl set-hostname <your-prefix>-prospector

# On server 2 (lead qualification)
clawhub install pilot-event-filter pilot-task-router pilot-dataset
pilotctl set-hostname <your-prefix>-qualifier

# On server 3 (outreach)
clawhub install pilot-email-bridge pilot-cron pilot-receipt
pilotctl set-hostname <your-prefix>-ou
...[truncated 3033 chars]
Remediation
View remediation

Remediation Suggestions

  1. Validate the prefix before using it. Apply a strict allowlist such as ^[A-Za-z0-9][A-Za-z0-9_-]{0,62}$ and reject all nonmatching values.
  2. Place the validated value in a variable and quote every expansion:
    bash
    prefix="$VALIDATED_PREFIX"
pilotctl --json set-hostname "${prefix}-prospector"
pilotctl --json handshake "${prefix}-qualifier" "setup: sales-pipeline"
  3. Prefer direct process invocation with an argument array rather than generating and executing a shell command string.
  4. Do not use eval, bash -c, or equivalent reparsing mechanisms with user-derived content.
  5. Validate role names against the fixed set prospector, qualifier, outreach, and crm-sync.
  6. Add an explicit instruction that the agent must reject whitespace, control characters, shell metacharacters, command substitutions, path separators, and leading hyphens in deployment identifiers.
  7. Apply the same validation and safe argument handling to hostname, handshake, subscribe, and publish examples in both documentation files.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:39
Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md, lines 39-49
  • README.md, lines 44-59

Vulnerability Type: Installation of mutable third-party dependencies without version, integrity, or publisher constraints
Risk Level: Medium

Affected code from SKILL.md:

bash
# prospector:
clawhub install pilot-discover pilot-stream-data pilot-metrics
# qualifier:
clawhub install pilot-event-filter pilot-task-router pilot-dataset
# outreach:
clawhub install pilot-email-bridge pilot-cron pilot-receipt
# crm-sync:
clawhub install pilot-webhook-bridge pilot-audit-log pilot-slack-bridge

Affected code from README.md:

bash
# On server 1 (lead prospecting)
clawhub install pilot-discover pilot-stream-data pilot-metrics
pilotctl set-hostname <your-prefix>-prospector

# On server 2 (lead qualification)
clawhub install pilot-event-filter pilot-task-router pilot-dataset
pilotctl set-hostname <your-prefix>-qualifier

# On server 3 (outreach)
clawhub install pilot-email-bridge pilot-cron pilot-receipt
pilotctl set-hostname <your-prefix>-outreach

# On server 4 (CRM sync)
clawhub install pilot-webhook-bridge pilot-audit-log pilot-slack-bridge
pilotctl set-hostname <your-prefix>-crm-sync

Technical Analysis

The setup installs twelve externally supplied Skills solely by package name. No immutable version, content digest, lock file, trusted publisher identity, signature-verification step, or preinstallation review requirement is provided.

Consequently, the dependencies resolved when the setup is executed may differ from those that existed when this project was audited. A compromised registry account, malicious package update, dependency confusion condition, or registry-side package replacement could cause the setup to install unreviewed instructions or executable content.

The dependency implementations are not present in this project, so their intern ...[truncated 1415 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every dependency to an immutable reviewed version and, where supported, a cryptographic content digest.
  2. Maintain a lock file or signed manifest recording package name, exact version, digest, publisher, and required permissions.
  3. Require signature and trusted-publisher verification before installation.
  4. Install only from an explicitly approved registry or internal mirror; disable fallback to unknown package sources.
  5. Audit every dependency and its transitive components before approving a new version.
  6. Use an explicit update process that reviews diffs and reruns security checks rather than automatically resolving the latest release.
  7. Execute installed Skills with least privilege, restricted filesystem access, scoped credentials, and destination-based network controls.
  8. Document expected permissions and data access for each Skill so unexpected capability changes cause installation to fail.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly orchestrates collection and transmission of prospect, contact, engagement, and CRM data across multiple agents and to external systems, but provides no privacy notice, consent considerations, data minimization guidance, or handling constraints. In a sales automation context this can lead operators to process personal and business data in ways that violate policy or compliance requirements, especially when enrichment, email outreach, webhook sync, and Slack reporting are involved.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The README states that trust is auto-approved once both sides send handshakes, removing a human verification step before establishing agent-to-agent trust. In a multi-agent pipeline that moves lead and CRM data, this increases the risk of misbinding, unauthorized data sharing, or accidental trust establishment with a spoofed or misnamed agent, after which sensitive pipeline data can flow automatically.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash
# On prospector:

Session Persistence

Medium
Category
Rogue Agent
Confidence
92% confidence
Finding

This skill creates persistent local state by writing a setup manifest into the user's home directory. Persistent agent configuration can outlive the session, influence later behavior, and expose environment details or workflow metadata on multi-user or managed hosts if users were not informed.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/sales-pipeline.json << 'MANIFEST'

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest says this skill should be used to deploy and configure a sales pipeline and related agents, not to carry out prospecting operations itself. The prospector role template explicitly describes operational lead collection from web scraping, social signals, and LinkedIn, which is a distinct capability not justified by a setup-only skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifests and data-flow section indicate that lead and engagement data may be sent to external systems, including CRM webhooks and Slack, but the skill description does not clearly disclose this. Undisclosed external transmission can expose personal or business-sensitive data, create compliance issues, and cause users to enable integrations they did not fully understand.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The setup writes a persistent manifest under ~/.pilot/setups without clearly warning the user in the skill description or before execution. Silent persistence can surprise users, leave residual configuration on shared systems, and make rollback or auditing harder.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.