Pilot Scientific Research Team Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:39 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for setting up a research-agent pipeline, but it grants broad setup, trust, and external publishing capabilities without enough scoping or safety checks.

Review this carefully before installing. Use only reviewed and pinned dependency versions, validate the deployment prefix as a hostname-safe label, manually verify peer identities before handshakes, and keep external report/webhook publication disabled until a human has approved the content and destination.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48

Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

-literature # On hypothesis generation server clawhub install pilot-task-router pilot-priority-queue pilot-dataset pilotctl set-hostname -hypothesis # On experiment execution server clawhub install pilot-task-router pilot-audit-log pilot-metrics pilotctl set-hostname -experiment # On report writing server clawhub install pilot-share pilot-announce pilot-webhook-bridge pilotctl set-hostname -report ``` ### Technical Analysis The setup procedure installs multiple third-party Skills from the `clawhub` registry using names alone. It does not pin immutable versions or content digests, verify package signatures or publisher identities, validate checksums, or require a security review of the retrieved packages. Consequently, the code ultimately installed can differ from the dependencies that were available when this project was audited. This creates a mutable supply-chain boundary. The risk is particularly significant for dependencies that process research data, communicate with peers, or publish externally, such as `pilot-stream-data`, `pilot-share`, and `pilot-webhook-bridge`. This finding does not establish that any named dependency is currently mal ...[truncated 1739 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: README.md:41

Finding

User-Controlled Prefix Can Be Unsafely Interpolated into Shell Commands

Content

View full analysis

-literature # On hypothesis generation server clawhub install pilot-task-router pilot-priority-queue pilot-dataset pilotctl set-hostname -hypothesis # On experiment execution server clawhub install pilot-task-router pilot-audit-log pilot-metrics pilotctl set-hostname -experiment # On report writing server clawhub install pilot-share pilot-announce pilot-webhook-bridge pilotctl set-hostname -report ``` The same pattern is used in handshake commands: ```bash # literature <-> hypothesis (literature synthesis) # On literature: pilotctl handshake -hypothesis "setup: scientific-research-team" # On hypothesis: pilotctl handshake -literature "setup: scientific-research-team" # hypothesis <-> experiment (research hypotheses) # On hypothesis: pilotctl handshake -experiment "setup: scientific-research-team" # On experiment: pilotctl handshake -hypothesis "setup: scientific-research-team" # experiment <-> report (experimental results) # On experiment: pilotctl handshake -report "setup: scientific-research-team" # On report: pilotctl handshake -experiment "setup: scientific-research-team" ``` ### Technical Analysis The prefix is user-controlled, but the instructions do not define a hostname-safe all ...[truncated 2733 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README states that the report writer publishes research reports externally over a secure channel, but it provides no warning that sensitive or unpublished research may leave the internal agent boundary. In a scientific workflow, this can lead to unintentional disclosure of embargoed results, proprietary data, or regulated information despite transport security.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The data-flow diagram shows outbound transmission from the report agent to an external destination, but it omits any notice that this crosses a trust boundary. Users may configure the pipeline assuming all traffic remains internal, increasing the chance of accidental external disclosure.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

Auto-approving trust whenever both sides exchange handshakes removes any human verification of peer identity or authorization. If an attacker can register a similarly named agent or induce a handshake from a compromised node, they may gain trusted communication paths and receive sensitive research data or inject fabricated results into the pipeline.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# literature <-> hypothesis (literature synthesis)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation says the report agent should publish the final report for secure external access on port 443, which implies sending data to an external destination. However, the command shown publishes to <your-prefix>-report, i.e. the same internal report agent, so the documented intent contradicts the actual demonstrated operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example workflow encourages publishing a final report intended for external access without instructing the user to verify contents, citations, or disclosure permissions first. In this skill context, automated research reporting increases the risk that confidential, inaccurate, or noncompliant material will be disseminated.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

clawhub install pilot-share pilot-announce pilot-webhook-bridge

text

**Step 3:** Set the hostname and write the manifest to `~/.pilot/setups/scientific-research-team.json`.

**Step 4:** Tell the user to initiate handshakes with the peers for their role.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly defines a report -> external data flow and a pilot-webhook-bridge capability to push reports to external platforms, but it does not require explicit user confirmation, destination validation, or any warning that data is leaving the local agent network. In a research workflow, reports and experimental outputs may contain unpublished, sensitive, proprietary, or regulated information, so silent or poorly understood external transmission creates a real data exfiltration risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.