ClawHub
Back to skill

Security audit

Pilot Service Agents Transit

Security checks for vulnerabilities and agentic risk

Overview

This skill provides read-only public transit data through a disclosed Pilot Protocol workflow, with a minor scope mismatch around listed bike-share agents.

Before installing, confirm you are comfortable using Pilot Protocol and sending transit or location-related queries to remote agents. The publisher should align the bike-share documentation, but the inspected skill is read-only and does not install code or request private local access.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest explicitly says not to use this skill for city bike-share, directing users to a different skill. However, the documented agent snapshot includes several GBFS bike-share providers such as Bluebikes, Capital Bikeshare, Divvy, Lyft Bay Area, and Toronto Bikeshare, which broadens the skill beyond the stated transit-only scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation frames the skill as read-only public-transit information and specifically says not to expect rideshare/taxi, while the broader manifest also excludes city bike-share. The included agent list actively contradicts that stated scope by enumerating several bike-share data agents, creating intent-level confusion about what the skill is for.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.