ClawHub
Back to skill

Security audit

Pilot Swarm Task Farm Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but it should be reviewed carefully because it installs multiple external skills and creates persistent, auto-approved agent trust relationships without enough security scoping.

Before installing, use this only on hosts you control, pin and verify every companion skill, confirm peer identities before handshaking, restrict port 1002 and Slack destinations, and know how to remove the ~/.pilot manifest and revoke trust entries.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:48
Finding

Unpinned Third-Party Skill Installation

Content
View full analysis
-leader # On each worker node (repeat for worker-1, worker-2, worker-3) clawhub install pilot-swarm-join pilot-map-reduce pilot-task-retry pilot-metrics pilotctl set-hostname -worker-1 # On monitor node clawhub install pilot-task-monitor pilot-mesh-status pilot-slack-bridge pilot-metrics pilotctl set-hostname -monitor ``` ### Technical Analysis The setup installs multiple third-party Skills by mutable package name without specifying immutable versions, content digests, signatures, or an explicitly trusted registry. The installed packages are not included in this repository, so their effective instructions and executable behavior cannot be verified from the audited files. If the package source, publisher account, or a future package release is compromised, the same installation commands may retrieve content different from what was originally reviewed. Because these dependencies operate in leader, worker, and monitor roles, a malicious update could execute within the privileges and tool access granted to those agents. This finding does not establish that any named dependency is currently malicious. It identifies an unsafe depe ...[truncated 1893 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README advertises automatic worker join/retry behavior and Slack reporting, but does not warn that task data, metadata, or operational status may be forwarded to external systems or trusted peers with limited human review. In a distributed swarm setup, this increases the chance of oversharing sensitive workload details and normalizes insecure defaults for inter-agent trust and telemetry export.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The autonomous trust-approval behavior delegates a sensitive security decision to automation rather than requiring human verification. Although intended for convenience, autonomous approval of peer trust in a swarm context can enable unauthorized coordination, task injection, or data access if naming, discovery, or handshake assumptions are abused.

Content

Scanner excerpt · README.md (reported line 70)May include surrounding context.

2. Establish trust

Each worker must handshake the leader and monitor. The leader must handshake all workers and the monitor. When both sides handshake, trust is auto-approved.

bash
# On leader:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The setup directs operators to establish mutual handshakes and states that trust is automatically approved once both sides handshake, without any warning or secondary verification step. In a self-organizing multi-agent environment, auto-approval can let an unintended or spoofed node gain trusted access to task distribution, results, and monitoring flows, materially expanding the blast radius of compromise.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The skill directs the agent to write a manifest under ~/.pilot/setups, creating persistent local state that may survive the session without notifying the user about retention, contents, or cleanup. Because the manifest includes topology, role, hostnames, and trust relationships, it can leak operational details or be reused unintentionally in later runs.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

clawhub install pilot-task-monitor pilot-mesh-status pilot-slack-bridge pilot-metrics

text

**Step 3:** Set hostname and write manifest to `~/.pilot/setups/swarm-task-farm.json`.

**Step 4:** Handshake — workers trust leader + monitor; leader trusts all workers + monitor.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs the operator to establish trust handshakes and send task data, results, and health metrics across multiple hosts, but it provides no warning about authentication scope, sensitive data exposure, or the operational impact of connecting five agents into a distributed mesh. In this context, users may unknowingly create lateral communication paths and telemetry flows that expose internal workload details or expand attack surface without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.