ClawHub
Back to skill

Security audit

Pilot Translation Pipeline Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent translation-pipeline purpose, but it needs Review because it runs setup commands from user-provided names without validation while installing and linking multiple agents.

Install only after reviewing and pinning the dependent skills, using a simple hostname-safe prefix such as lowercase letters, numbers, and hyphens only, verifying each peer before handshakes, and confirming any webhook destination is approved for the translated content.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:43
Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content
View full analysis
-extractor # On server 2 (translation engine) clawhub install pilot-task-router pilot-task-parallel pilot-receipt pilotctl set-hostname -translator # On server 3 (quality reviewer) clawhub install pilot-review pilot-alert pilot-webhook-bridge pilotctl set-hostname -reviewer ``` ### Technical Analysis The setup instructions install nine packages from ClawHub without specifying immutable versions, content hashes, signatures, or verified publisher identities. The effective code installed by these commands can therefore differ from the code that existed when this project was audited. This is an insecure dependency-management practice because the project delegates execution capabilities to mutable third-party packages. If a package publisher account or registry entry is compromised, or if an unexpected package is resolved, the installed Skill may contain behavior that was never reviewed as part of this project. The risk is amplified by `SKILL.md` declaring Bash as an allowed tool. A dependency loaded by the agent may consequently influence commands or operations performed with the invoking user's permissions. ### Attack Path 1. An attacker compromises a referenced package, its publisher account, or the relevant registry distribution channel. 2. The attacker publishes a malicious replacement under one of the referenced ...[truncated 1158 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:39
Finding

Unvalidated User-Controlled Prefix Is Interpolated into Shell Commands

Content
View full analysis
- ``` Additional affected commands appear in `SKILL.md:163-169`: ```bash # extractor and translator handshake with each other: pilotctl --json handshake -translator "setup: translation-pipeline" pilotctl --json handshake -extractor "setup: translation-pipeline" # translator and reviewer handshake with each other: pilotctl --json handshake -reviewer "setup: translation-pipeline" pilotctl --json handshake -translator "setup: translation-pipeline" ``` The same pattern is used in `SKILL.md:176-185`: ```bash # On translator — subscribe to source content: pilotctl --json subscribe -extractor source-content # On reviewer — subscribe to translated content: pilotctl --json subscribe -translator translated-content # On extractor — publish source content: pilotctl --json publish -translator source-content '{"source_lang":"en","target_lang":"es","segments":[{"id":"s1","text":"Autonomous agents are transforming software deployment."}]}' # On translator — publish translated content: pilotctl --json publish -reviewer translated-content '{"source_lang":"en","target_lang":"es","segments":[{"id":"s1","translated":"Los agentes autonomos estan transformando el despliegue de software.","confidence":0.94}]}' ``` ### Technical Analysis The Skill explicitly treats the deployment prefix as user-provided data and embeds it into Bash command templates without defining valid ...[truncated 2307 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The reviewer role is designed to publish approved translations to external systems via webhook, but the skill description does not prominently warn that potentially sensitive translated content may leave the environment. This creates privacy, confidentiality, and integrity risks because users may enable the pipeline without understanding that data can be exfiltrated or pushed into external destinations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description states that the reviewer publishes approved translations to external systems, which can transmit user or organizational content outside the local environment. The README does not include any warning about reviewing data sensitivity, privacy implications, or validating the external destination before publication.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

The trust model auto-approves a relationship once both sides send handshakes, with no manual verification step or out-of-band identity confirmation described. If an operator targets the wrong hostname or an attacker can induce reciprocal handshakes, agents may automatically trust an unintended peer and exchange pipeline data without sufficient validation.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash
# On translator:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The example shows approved translations being published with a destination of https://example.com/api/translations, demonstrating outbound transmission of translation data. For markdown files, this should be accompanied by an explicit warning that content may leave the system and could include sensitive or regulated text.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to change the hostname and write a persistent manifest under the user's home directory, but the description does not warn the user about these state-changing side effects. This can cause unexpected configuration drift and persistence on the host, especially if the user expects a dry-run or advisory workflow rather than a system-modifying setup.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

The manifest-writing step creates a persistent configuration artifact in ~/.pilot/setups, which survives the current session and may influence future agent behavior. While persistence is expected for a setup skill, it is still security-relevant because it silently establishes durable state that may be relied upon later or expose workflow metadata to other local processes/users.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/translation-pipeline.json << 'MANIFEST'

Static analysis

No suspicious patterns detected.