Security audit

Pilot Service Agents News

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documented public-feed query helper with a few broadly scoped content sources, but no hidden code, persistence, credential access, or destructive behavior was found.

Install this only if you are comfortable using Pilot Protocol and pilotctl to query remote public data agents on network 9. Expect some catalogue entries to be broader than strict news, and check each agent's /help output before sending queries, especially if your prompt contains private context.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is marketed as a news/current-events capability, but the enumerated agents include several unrelated data sources such as brewery directories, book/library trends, and Wayback lookups. This scope mismatch can mislead downstream agents or users into invoking broader capabilities than intended, weakening least-privilege assumptions and creating tool-routing or data-governance risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Including OpenBreweryDB in a news/current-events skill is a clear capability mismatch unrelated to the declared purpose. This increases attack surface and can enable unauthorized or unexpected use of a directory-style data source under the cover of a benign news tool, especially in automated tool-selection pipelines.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: OpenLibrary trending and MediaWiki featured content are adjacent to general public-interest content, but they still exceed a narrowly defined current-news/newsfeed scope. In context, this is more of a scope-control and trust-boundary issue than a direct exploit primitive, but it can still mislead autonomous agents into using broader sources than intended.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Wayback Machine snapshot lookup is not inherently dangerous, but it extends the skill from current-news retrieval into historical web archival access without clear justification. That broadening can cause an orchestrator to use this skill for unintended retrieval tasks, increasing the chance of policy bypass or unexpected data access paths.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.