Security audit

Pilot Service Agents Geo

Security checks for vulnerabilities and agentic risk

Overview

This geography skill needs review because it can route precise location or device data to external services and documents a flight-tracking agent despite saying flight tracking is out of scope.

Install only if you are comfortable with location queries being sent through Pilot Protocol service agents and upstream providers. Confirm before sending exact addresses, coordinates, IP addresses, WiFi or cell observations, verify the selected hostname and provider, and avoid using the documented aircraft-state agent until the package scope is clarified. Run it with the least local privilege available and prefer a restricted pilotctl interface over unrestricted Bash where possible.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:26
Finding: Overly Broad Bash Tool Permission Violates Least Privilege
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:93
Finding: Sensitive Geolocation Data May Be Transmitted to Dynamically Discovered External Agents
Content: View full analysis
--data "/help" pilotctl --json inbox # Fetch structured data pilotctl --json send-message --data '/data {json filters}' pilotctl --json inbox # Natural-language summary (Gemini) pilotctl --json send-message --data '/summary {json filters}' pilotctl --json inbox ``` The documented catalogue also includes a service that can locate a user from sensitive device and network observations: ```markdown | `gcp-maps-geolocation` | Google Geolocation — locate from WiFi/cell/IP (premium) | | `gcp-maps-places-new` | Google Maps Places (New) — text place search (premium) | | `gcp-maps-pollen` | Google Maps Pollen — forecast by coord (premium) | ``` ### Technical Analysis The workflow instructs the agent to join an external overlay, dynamically discover service agents, and submit JSON filters to selected hostnames. Depending on the requested operation, those filters may contain exact addresses, coordinates, IP addresses, Wi-Fi observations, cell information, or travel endpoints. Dynamic discovery increases the trust-management burden because the catalogue can change after the skill has been reviewed. The documentation does not specify hostname authentication requirements, a trusted-agent allowlist, user-consent controls, data-retention limits, or mandatory minimization of sensitive fields. The `/summary` operation also documents Gemini-based processing, introducing another external processing context. The external-service behavior is disclosed rather than hidden, and the reviewed package contains no evidence that data is aut ...[truncated 1530 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The top-level description narrows expected use to address conversion, routing, elevation, timezone, air quality, and place/address validation, while the catalogue exposes materially broader capabilities such as pollen, solar, roads snapping, Overpass queries, and country/currency lookups. Under-disclosed functionality increases the risk of misuse, incorrect tool selection, and policy bypass because operators may not realize the skill can access or return data outside its stated purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest explicitly says the skill should not be used for flight tracking, but the documented catalogue includes opensky-bbox, which provides live aircraft states in a bounding box. This mismatch can cause downstream agents or users to invoke flight-tracking capability despite policy expectations, weakening scope controls and enabling unintended access to sensitive or regulated data flows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill advertises IP geolocation and Google geolocation from WiFi/cell/IP without any privacy warning, consent requirement, or data-handling note. Because these lookups can reveal approximate user location or infer physical presence from network/device identifiers, omission of privacy guidance can lead to collection or transmission of sensitive location data without adequate user awareness or controls.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.