ClawHub
Back to skill

Security audit

Pilot Service Agents Finance

Security checks for vulnerabilities and agentic risk

Overview

This skill is a read-only public finance-data connector, but its catalog and scope wording should be read carefully because it mixes market, macroeconomic, and SEC-related agents.

Install only if you are comfortable using Pilot Protocol service agents for public finance data. Treat the agent table as broader than the name suggests, verify each agent with /help before querying it, and use the dedicated government-finance or economics skills for SEC filings and macroeconomic indicators when separation by domain matters.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documented agent catalog includes clearly out-of-scope services such as SEC EDGAR search and GDP/debt data, despite the manifest claiming the skill is limited to public market and FX endpoints. In an agentic environment, these contradictory instructions can misroute queries to sensitive or higher-trust domains, weakening separation-of-duties and causing policy bypass through documentation-driven tool selection.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill manifest and usage guidance conflict on whether macroeconomic indicators are in scope. This can cause an orchestrator or human operator to invoke the skill for disallowed data domains, undermining routing controls and increasing the chance of retrieving unintended data sources or bypassing domain-specific review paths.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.