ClawHub
Back to skill

Security audit

Pilot Social Media Manager Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent social-media agent setup purpose, but it changes agent configuration, installs mutable dependencies, and establishes persistent trust paths without enough validation or verification guidance.

Review this before installing in a production or brand-owned social media environment. Use a simple hostname-safe prefix, verify each peer agent out of band before handshakes, pin and verify the companion skill versions, and understand that it will change Pilot configuration and leave a manifest under ~/.pilot/setups.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:48
Finding

Unpinned Third-Party Skill Installations Create a Supply-Chain Risk

Content
View full analysis
-planner # On server 2 (content creator) clawhub install pilot-task-router pilot-share pilot-receipt pilotctl set-hostname -creator # On server 3 (performance analyst) clawhub install pilot-metrics pilot-event-log pilot-alert pilotctl set-hostname -analyst ``` ### Technical Analysis The setup instructions install nine externally maintained skills by package name without specifying immutable versions, cryptographic digests, trusted publisher identities, or integrity-verification steps. Consequently, the packages resolved when the commands are executed may differ from those that existed when this project was reviewed. The effective behavior of the deployed system therefore depends on mutable content outside this repository. A compromised registry account, malicious package update, dependency-name takeover, or registry compromise could cause users to install altered skill instructions or executable components. This finding does not establish that any named dependency is currently malicious. It identifies the absence of controls needed to ensure that the installed dependencies are the same artifacts that were reviewed and approved. ### Attack Path 1. An attacker compromises the publisher account or distribution channel for one of the named skills, or otherwise gains control of the package name. 2. The attacker publi ...[truncated 1041 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:44
Finding

Unvalidated User-Controlled Prefix Is Interpolated into Shell Commands

Content
View full analysis
- ``` ```bash # planner <-> creator: pilotctl --json handshake -creator "setup: social-media-manager" pilotctl --json handshake -planner "setup: social-media-manager" # creator <-> analyst: pilotctl --json handshake -analyst "setup: social-media-manager" pilotctl --json handshake -creator "setup: social-media-manager" # analyst <-> planner: pilotctl --json handshake -planner "setup: social-media-manager" pilotctl --json handshake -analyst "setup: social-media-manager" ``` ```bash # On creator -- subscribe to content briefs: pilotctl --json subscribe -planner content-brief # On analyst -- subscribe to published posts: pilotctl --json subscribe -creator post-published # On planner -- subscribe to performance insights: pilotctl --json subscribe -analyst performance-insight # On planner -- publish a content brief: pilotctl --json publish -creator content-brief '{"platforms":["linkedin","x"],"topic":"AI in DevOps","tone":"professional"}' # On analyst -- publish insights back to planner: pilotctl --json publish -planner performance-insight '{"top_platform":"linkedin","engagement_rate":4.2}' ``` The same unsafe substitution pattern appears in the README, including: ```bash pilotctl set-hostname -planner p ...[truncated 2820 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The README instructs operators that mutual handshakes result in trust being auto-approved with no manual verification step. That creates an insecure trust-on-first-use style workflow where identity or authorization is not independently validated, making accidental pairing with the wrong host, spoofed peers, or unauthorized inter-agent communication more likely. In this skill’s context, the risk is elevated because three agents exchange ongoing operational data in a continuous loop, so a wrongly trusted peer could inject briefs, falsify analytics, or receive internal workflow data.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash
# planner <-> creator

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill changes the agent hostname and directs the user to establish handshakes with peer agents, but the description does not clearly warn that this modifies system/agent configuration and enables communications with other agents. That omission is security-relevant because users may unknowingly authorize trust relationships and message paths that expand the attack surface.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Writing a setup manifest to ~/.pilot/setups creates session persistence by storing configuration that survives the current interaction. In this skill context, persistence is expected for setup automation, but it is still security-relevant because future agent behavior can be influenced by a file the user may not realize was created.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/social-media-manager.json << 'MANIFEST'

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs the agent to create and write a manifest under ~/.pilot/setups but does not warn the user that it will persist configuration data in the user's home directory. This is a real transparency and consent issue because it changes local state and may leave behind operational metadata that the user did not explicitly expect.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.