Pilot Threat Intelligence Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:39 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for threat-intelligence setup, but it can affect production security controls and installs mutable dependencies without enough scoping or verification guidance.

Review this skill before installing in production. Confirm the exact dependency versions and publishers, verify peer identities before handshakes, test distributor behavior in a non-production environment, and make sure any external STIX/TAXII, SIEM, firewall, or IDS/IPS destinations are approved and reversible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:54

Finding

Unpinned Third-Party Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 54–63
Vulnerability Type: Supply-chain risk from unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

# For collector:
clawhub install pilot-stream-data pilot-cron pilot-archive
# For enricher:
clawhub install pilot-dataset pilot-task-router pilot-event-filter
# For analyzer:
clawhub install pilot-metrics pilot-consensus pilot-alert
# For distributor:
clawhub install pilot-webhook-bridge pilot-announce pilot-audit-log

The same insecure installation pattern also appears in README.md, lines 46–58:

bash

# On intel collection node
clawhub install pilot-stream-data pilot-cron pilot-archive
pilotctl set-hostname <your-prefix>-collector

# On enrichment node
clawhub install pilot-dataset pilot-task-router pilot-event-filter
pilotctl set-hostname <your-prefix>-enricher

# On analysis node
clawhub install pilot-metrics pilot-consensus pilot-alert
pilotctl set-hostname <your-prefix>-analyzer

# On distribution node
clawhub install pilot-webhook-bridge pilot-announce pilot-audit-log
pilotctl set-hostname <your-prefix>-distributor

Technical Analysis

The setup procedure directs an Agent or operator to install twelve third-party Skills by mutable package name. It does not specify immutable versions, content hashes, trusted source constraints, signature verification, or publisher identity checks.

Consequently, the effective behavior of this project depends on external components whose contents are not included in the audited repository. A registry compromise, publisher-account compromise, dependency-confusion condition, or malicious future package release could cause the same documented commands to resolve to altered content after this project has been reviewed.

This is a supply-chain weakness rather than evidence that any currently named dependency is malicious. The ...[truncated 1653 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every Skill to a reviewed, immutable version rather than installing by package name alone.
2. Prefer content-addressed installation and record a cryptographic digest for every dependency.
3. Require registry signature verification and validate the publisher identity before installation.
4. Explicitly configure an approved registry or repository instead of relying on an implicit package source.
5. Generate and maintain a dependency lock file or equivalent manifest containing exact versions and hashes.
6. Audit the complete contents and transitive dependencies of all twelve Skills before deployment.
7. Run installed Skills with least privilege, restricted filesystem access, and narrowly scoped network permissions.
8. Add automated integrity verification so deployment fails closed when a version, signature, or digest differs from the reviewed artifact.
9. Document a controlled dependency-update process requiring security review before changing pinned versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown explicitly states that the distributor pushes IOC updates to firewalls, IDS/IPS, and SIEM platforms, which can affect production security controls and transmit operational data externally. The document does not include any caution, prerequisite validation, or user warning about the operational impact of publishing or blocking actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The trust model auto-approves communication once both sides exchange handshakes, with no manual verification or explicit identity validation step described. In a threat-intelligence pipeline that can publish blocking actions and feed downstream security controls, mistaken or spoofed trust establishment could allow unauthorized agents to inject false intelligence, trigger bad detections, or distribute harmful blocking rules.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# collector <-> enricher (raw IOCs)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

This skill instructs the agent to write a manifest file into the user's home directory, creating persistent session/configuration state across runs. Persistent writes are security-relevant because they modify user environment state and may expose operational metadata such as hostnames, peer names, and topology if performed without explicit consent or disclosure.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

clawhub install pilot-webhook-bridge pilot-announce pilot-audit-log

text

**Step 3:** Set the hostname and write the manifest to `~/.pilot/setups/threat-intelligence.json`.

**Step 4:** Tell the user to initiate handshakes with the peers for their role.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown describes distributor -> external over port 443 and says it publishes STIX/TAXII feeds to security infrastructure, which is a network transmission of potentially sensitive threat intelligence. The file explains the data flow but does not include a user-facing warning about external transmission, privacy, or downstream impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file instructs the agent to write a manifest to ~/.pilot/setups/threat-intelligence.json, which modifies user data on disk. While the setup purpose is deployment-related, the documentation does not explicitly warn the user that the procedure creates or overwrites a local file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.