Pilot Security Operations Center Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:16 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent SOC setup guide, but it gives agents broad Bash-driven setup authority for automatic enforcement, trust pairing, external reporting, and mutable dependency installs without enough safeguards.

Review this skill carefully before installing. Use only reviewed and pinned dependency versions, validate the deployment prefix as a simple hostname-safe value, confirm peer identities before handshakes, and disable or tightly scope Slack/webhook reporting and automatic block/quarantine actions until tested in a controlled environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:50

Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

-collector # On analysis node clawhub install pilot-event-filter pilot-event-replay pilot-alert pilot-priority-queue pilotctl set-hostname -analyzer # On enforcement node clawhub install pilot-blocklist pilot-quarantine pilot-webhook-bridge pilot-audit-log pilotctl set-hostname -enforcer # On dashboard node clawhub install pilot-metrics pilot-slack-bridge pilot-network-map pilot-mesh-status pilotctl set-hostname -dashboard ``` ### Technical Analysis The setup installs multiple registry-hosted skills by mutable package name. It does not specify exact versions, immutable package digests, trusted publisher identities, signatures, or a reviewed dependency lockfile. Several dependencies provide security-sensitive functionality, including scheduling, event collection, audit logging, blocklisting, quarantine, webhook delivery, and Slack integration. Their implementations are not included in this project, so their behavior cannot be verified from the audited artifact. Consequently, the effective installation can change after this skill has been reviewed. A com ...[truncated 1596 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: README.md:40

Finding

Unvalidated Deployment Prefix Can Produce Shell Command Injection

Content

View full analysis

` with a unique name for your deployment (e.g. `acme`). ``` ```bash # On log collection node clawhub install pilot-event-log pilot-audit-log pilot-stream-data pilot-cron pilotctl set-hostname -collector # On analysis node clawhub install pilot-event-filter pilot-event-replay pilot-alert pilot-priority-queue pilotctl set-hostname -analyzer # On enforcement node clawhub install pilot-blocklist pilot-quarantine pilot-webhook-bridge pilot-audit-log pilotctl set-hostname -enforcer # On dashboard node clawhub install pilot-metrics pilot-slack-bridge pilot-network-map pilot-mesh-status pilotctl set-hostname -dashboard ``` The same value is subsequently embedded in handshake and publication commands without validation or quoting: ```bash pilotctl handshake -analyzer "soc pipeline" pilotctl publish -analyzer security-event '{"type":"auth_failure","source":"10.0.1.50","user":"admin","attempts":15}' ``` `SKILL.md` explicitly instructs the agent to ask for this value: ```markdown **Step 1:** Ask the user which role and prefix. ``` It later interpolates that prefix into Bash examples: ```bash # On collector: pilotctl --json publish -analyzer security-event '{"type":"port_scan","source":"203.0.113.42","ports":1024}' # On analyzer: pilotctl --json publish -enforcer threat-verdict '{"source":"203.0.113.42","severity":"high","action":"block"}' # On enforcer: pilotctl --json publish -dashboard enforcement-action '{"source":"203.0.11 ...[truncated 2798 chars]

Remediation

View remediation

&2 exit 1 } pilotctl set-hostname "${prefix}-collector" ``` 7. Insert `--` before user-derived positional arguments where supported to prevent option injection. 8. Repeat validation independently on every host rather than relying on prior conversational validation. 9. Update `SKILL.md` to explicitly prohibit executing commands until the prefix has passed validation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README promotes automatic blocking and quarantine actions but does not warn operators that these actions can disrupt legitimate traffic, isolate healthy nodes, or cause cascading outages if detections are wrong. In a SOC/enforcement context, omission of those warnings increases the chance of unsafe deployment and misuse of powerful response capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The dashboard is described as sending summary reports to Slack without warning that security telemetry, indicators, hostnames, IPs, or incident details may be transmitted to a third-party external service. In a SOC setting this can create unintended data exposure, compliance issues, and leakage of sensitive operational information.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

Automatically approving trust as soon as both sides exchange handshakes removes a human verification step for establishing privileged agent-to-agent communication. In this skill's context, trusted peers can send threat verdicts, enforcement requests, and telemetry, so mistaken identity, spoofed naming, or unauthorized pairing could enable malicious commands or data exfiltration.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# collector <-> analyzer

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This is a session-persistence behavior because the skill writes a durable manifest into ~/.pilot/setups/security-operations-center.json for future reuse beyond the immediate interaction. In security tooling, persistent state is more sensitive than usual because it can encode topology, hostnames, and operational relationships that later automation or other local users/processes may consume.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

clawhub install pilot-metrics pilot-slack-bridge pilot-network-map pilot-mesh-status

text

**Step 3:** Set hostname and write manifest to `~/.pilot/setups/security-operations-center.json`.

**Step 4:** Handshake with adjacent agents.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill defines inter-agent data flows for security events and includes an external Slack integration, but the description does not warn that potentially sensitive security telemetry and enforcement data will be transmitted across agents and possibly to third-party services. This creates a real risk of unintended disclosure of incident data, host identifiers, or operational details if a user enables the setup without understanding the data-sharing behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs writing a manifest into the user's home directory but does not warn the user that it will create persistent local state under ~/.pilot/setups. Hidden persistence is a real safety issue because users may not expect configuration artifacts to be stored or later reused by other tooling, especially in an automation context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.