T08 · Insecure Dependencies
Warning
- Location
SKILL.md:43- Finding
Unpinned Third-Party Skill Installation Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Pilot Smart Home Coordinator Setup
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed smart-home setup guide, but it warrants review because it can connect agents that control home devices, auto-approves trust after handshakes, installs unpinned skills, and can send home status externally.
Review this before installing on any real smart-home environment. Use pinned and trusted dependency versions, choose a simple hostname prefix with only lowercase letters, numbers, and hyphens, verify peer identities before handshakes, and enable Slack/webhook/email summaries only if you are comfortable sending home-state data outside the local network.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:40- Finding
Unvalidated Deployment Prefix Can Enable Shell Command Injection
- Content
View full analysis
- mkdir -p ~/.pilot/setups ``` ``` The same unquoted prefix is used in handshake commands: ```bash # sensor-hub <-> brain: pilotctl --json handshake -brain "setup: smart-home-coordinator" pilotctl --json handshake -sensor-hub "setup: smart-home-coordinator" # brain <-> actuator: pilotctl --json handshake -actuator "setup: smart-home-coordinator" pilotctl --json handshake -brain "setup: smart-home-coordinator" # brain <-> dashboard: pilotctl --json handshake -dashboard "setup: smart-home-coordinator" pilotctl --json handshake -brain "setup: smart-home-coordinator" ``` ### Technical Analysis The skill instructs the agent to obtain a deployment prefix from the user and place it into Bash commands. It does not define a validation policy or require the substituted hostname argument to be safely quoted. If an implementation performs direct textual substitution and executes the resulting command through a shell, a prefix containing whitespace, shell metacharacters, command substitution, redirection, or command separators may change the command ...[truncated 1974 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 89% confidence
- Finding
The setup instructs that trust is automatically approved once both sides exchange handshakes, with no independent verification of identity, authorization, or out-of-band approval. In a smart-home context, this weak trust establishment can allow an unintended or spoofed agent using a similar hostname/prefix to become trusted and then receive sensor data or issue/relay device-control messages.
- Content
2. Establish trust
Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.
bash # sensor-hub <-> brain (sensor data flow)
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The dashboard role explicitly installs webhook and Slack bridge skills, which enable outbound transmission of smart-home status beyond the local coordinator's core sensing/decision/actuation purpose. In a home-automation context, this can expose occupancy patterns, device state, and other sensitive telemetry to third-party services without clear necessity or minimization.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
clawhub install pilot-metrics pilot-webhook-bridge pilot-slack-bridge
text **Step 3:** Set the hostname and write the manifest: ```bash pilotctl --json set-hostname <prefix>-<role> mkdir -p ~/.pilot/setups
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill describes outbound sharing via webhook/Slack but does not warn the operator that home telemetry may be transmitted to external parties. In this context, lack of disclosure is dangerous because users may deploy the setup assuming it is purely local while unintentionally exporting sensitive household status and activity information.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documented data flow includes
dashboard -> externalon port 443 for daily summaries, expanding the trust boundary from a local smart-home mesh to external services. Home-state summaries can reveal behavioral and occupancy information, so sending them off-device without strong justification or controls creates a real privacy and data-exposure risk.- Content
Static analysis
No suspicious patterns detected.