Pilot Supply Chain Orchestrator Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:10 AM UTC
• Version: 1.0.0

Overview

This setup skill is coherent for supply-chain agent orchestration, but it asks for broad setup authority around agent installs, persistent manifests, trust handshakes, supplier APIs, purchase orders, and escrow without enough scoping or version controls.

Review this carefully before installing in a real supply-chain or procurement environment. Pin and verify every dependent skill, run under least-privilege accounts, confirm the exact peers and hostnames before handshakes, inspect or back up any existing ~/.pilot setup file before writing, and avoid connecting supplier APIs, purchase-order flows, or escrow until endpoints and approval controls are validated.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45

Finding

Unpinned Third-Party Skill Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:45-56; duplicated in README.md:45-57
Vulnerability Type: Unpinned third-party dependencies installed from an external package registry
Risk Level: Medium

The setup procedure installs the following external skills without immutable version constraints, checksums, signatures, or documented publisher verification:

bash

# For inventory:
clawhub install pilot-metrics pilot-cron pilot-alert pilot-stream-data
# For routing:
clawhub install pilot-task-router pilot-stream-data pilot-receipt
# For procurement:
clawhub install pilot-webhook-bridge pilot-audit-log pilot-escrow
# For compliance:
clawhub install pilot-audit-log pilot-event-filter pilot-alert

The equivalent installation instructions in README.md:45-57 are:

bash

# On inventory warehouse server
clawhub install pilot-metrics pilot-cron pilot-alert pilot-stream-data
pilotctl set-hostname <your-prefix>-inventory

# On logistics routing server
clawhub install pilot-task-router pilot-stream-data pilot-receipt
pilotctl set-hostname <your-prefix>-routing

# On procurement server
clawhub install pilot-webhook-bridge pilot-audit-log pilot-escrow
pilotctl set-hostname <your-prefix>-procurement

# On compliance server
clawhub install pilot-audit-log pilot-event-filter pilot-alert
pilotctl set-hostname <your-prefix>-compliance

Technical Analysis

Each clawhub install command resolves dependencies by package name without selecting a reviewed, immutable release. Consequently, the installed content can differ from the content that existed when this project was audited. The project does not include the dependency source code or an integrity manifest, so the behavior of these installed skills cannot be verified from the audited artifact.

This creates a supply-chain exposure if a named package, its publisher account, or the package registry is compromi ...[truncated 1899 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every external skill to a reviewed immutable version or content digest using the syntax supported by ClawHub.
2. Record dependency versions and integrity hashes in a lockfile or signed manifest committed to the project.
3. Require cryptographic signature verification and validate publisher identity before installation.
4. Use an organization-controlled allowlist or trusted registry mirror containing only reviewed releases.
5. Review the complete contents and transitive dependencies of each skill before approving a version.
6. Perform installation and execution under least-privilege accounts with restricted filesystem, network, secret, and command access.
7. Add automated checks that reject unpinned dependencies, unexpected publisher changes, signature failures, and integrity mismatches.
8. Update both SKILL.md and README.md so their installation instructions use the same verified immutable dependency references.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The setup instructs operators that mutual handshakes automatically establish trust with no manual approval, which removes an independent authorization step for inter-agent connectivity. In a multi-agent supply-chain workflow handling procurement, routing, and compliance data, any mistaken, spoofed, or socially engineered handshake can create unauthorized trust relationships that enable sensitive data exchange or command injection across the pipeline.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# inventory <-> procurement (reorder requests)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The skill directs the agent to write persistent configuration to a fixed path in the user's home directory, which creates session persistence beyond the immediate interaction. Even though this is framed as legitimate setup, persistent state can unexpectedly survive later sessions, influence future behavior, or overwrite existing configuration if the user is not clearly informed and consent is not obtained.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

clawhub install pilot-audit-log pilot-event-filter pilot-alert

text

**Step 3:** Set the hostname and write the manifest to `~/.pilot/setups/supply-chain-orchestrator.json`.

**Step 4:** Tell the user to initiate handshakes with the peers for their role.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The setup directs the user to create manifests defining cross-agent data flows and to initiate peer handshakes, and the procurement role explicitly interfaces with supplier APIs. The skill documentation describes these communications but does not include a user-facing warning that setup may transmit operational or order data across peers and external systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file instructs the agent to write a manifest to ~/.pilot/setups/supply-chain-orchestrator.json, which affects user files. The description gives the action as part of setup but does not include any warning or disclosure that the skill will modify local configuration under the user's home directory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.