Pilot Status Page Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:39 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for building a status-page pipeline, but it asks agents to install multiple mutable dependencies, establish automatic trust, and publish incident data externally without enough scoping or review guidance.

Review this skill before installing. Use pinned and trusted dependency versions, validate the deployment prefix as a hostname-safe value, verify each peer identity before handshakes, and restrict what incident fields can reach public status pages, subscriber email, and Slack.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Unpinned Third-Party Skill Installation Creates Supply-Chain Risk

Content

View full analysis

-monitor # On server 2 (status aggregator) clawhub install pilot-event-filter pilot-dataset pilot-audit-log pilotctl set-hostname -aggregator # On server 3 (status publisher) clawhub install pilot-webhook-bridge pilot-announce pilot-slack-bridge pilotctl set-hostname -publisher ``` ### Technical Analysis The setup installs nine third-party skills using mutable package names without specifying exact versions, integrity hashes, trusted publisher identities, signatures, or an approved registry endpoint. The source code of these dependencies is not included in the audited project, so their behavior cannot be verified from this repository. Because dependency resolution occurs at installation time, the installed implementation may differ from the implementation originally reviewed. Registry compromise, publisher-account compromise, package takeover, dependency confusion, or a malicious future release could introduce arbitrary behavior into the deployed agents. The affected dependencies are intended to perform sensitive operations such as scheduled health checks, metrics collection, dataset storage, webhook delivery, announcements, and Slack integration. A compromised dependency could therefore inherit access to operational information, network connectivity, credentials made available to t ...[truncated 1444 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:56

Finding

Unquoted User-Controlled Prefix in Shell Commands

Content

View full analysis

- ``` `SKILL.md:103-108`: ```bash # monitor <-> aggregator: pilotctl --json handshake -aggregator "setup: status-page" pilotctl --json handshake -monitor "setup: status-page" # aggregator <-> publisher: pilotctl --json handshake -publisher "setup: status-page" pilotctl --json handshake -aggregator "setup: status-page" ``` Equivalent instructions in `README.md:40-65` include: ```bash pilotctl set-hostname -monitor pilotctl set-hostname -aggregator pilotctl set-hostname -publisher pilotctl handshake -aggregator "setup: status-page" pilotctl handshake -monitor "setup: status-page" pilotctl handshake -publisher "setup: status-page" pilotctl handshake -aggregator "setup: status-page" ``` ### Technical Analysis The hostname prefix is user-provided input. The documented Bash templates place that value into command lines without quoting it and do not require validation against a hostname-safe character set. If an agent performs textual substitution and executes the resulting command through a shell, whitespace, command substitutions, redirections, control operators, or other shell metacharacters in the supplied prefix may be interpreted as shell syntax rather than as part of a hostname. Quoting alone would mitigate shell token splitting and most metacharacter interpretation after safe variable expansion, but strict validation is also necessary because the value is intended to become a hostname ...[truncated 1731 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly describes sending public incident notifications to external subscribers via email and Slack but provides no warning about disclosure of service names, outage details, or internal incident metadata. In a status-page workflow, this omission can lead operators to publish sensitive operational information externally without considering sanitization, audience scope, or approval requirements.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

Automatic trust approval is a form of autonomous security decision-making: once both sides initiate handshakes, the system grants trust without human validation. In a multi-agent pipeline that forwards health data and triggers public communications, this increases the blast radius of misconfiguration, impersonation, or unauthorized agent enrollment.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# monitor <-> aggregator

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup instructs users that mutual handshakes cause trust to be auto-approved with no manual review, but it does not warn about the security consequences of establishing peer trust. In this pipeline, trusted agents can exchange status and incident data automatically, so a mistaken or spoofed pairing could enable unauthorized data flow or control over downstream notifications.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 88)May include surrounding context.

md

pilotctl subscribe <your-prefix>-aggregator status-update

# On <your-prefix>-monitor -- publish a health check:
pilotctl publish <your-prefix>-aggregator health-check '{"service":"api-gateway","endpoint":"https://api.acme.com/health","status":"degraded","response_ms":2340,"threshold_ms":500,"timestamp":"2025-03-15T14:22:00Z"}'

# On <your-prefix>-aggregator -- publish a status update to the publisher:
pilotctl publish <your-prefix>-publisher status-update '{"overall_status":"degraded","incident":true,"incident_id":"INC-2025-0018","affected_services":["api-gateway"],"uptime_24h":99.2,"message":"API gateway experiencing elevated response times"}'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/status-page.json << 'MANIFEST'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly routes status updates and incident notifications to external destinations, including a public status page API, subscribers, and Slack, but does not instruct the operator to review what data is included before publication. This creates a real risk of disclosing sensitive internal service names, incident metadata, infrastructure details, or operational context to third parties or the public during setup and use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.