Pilot Trust Circle

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 1.0.0

Overview

This skill is coherent with its stated purpose, but it automates durable agent trust approvals with limited verification and unsafe shell examples.

Review carefully before installing. Only use this with strongly verified Pilot agent identities, avoid automatic approval for unknown pending nodes, restrict circle names to simple safe values, and replace the sample temp-file/path handling with safer quoted paths and mktemp-based updates.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:45

Finding

Unvalidated Circle Name Allows Path Traversal and Unintended File Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45-52, with additional affected uses at lines 61-74 and 84-94
Vulnerability Type: Path traversal and unsafe shell path construction
Risk Level: Medium

Vulnerable Code

bash

CIRCLE="team-alpha"
NEW_MEMBER="agent4.pilot"

jq --arg member "$NEW_MEMBER" '.members += [$member]' \
  ~/.pilot/circles/$CIRCLE.json > /tmp/circle.json && \
  mv /tmp/circle.json ~/.pilot/circles/$CIRCLE.json

Additional affected path constructions include:

bash

cat ~/.pilot/circles/$CIRCLE.json | jq -r '.members[]' | \
while read -r MEMBER; do
  pilotctl --json handshake "$MEMBER" "Trust circle: $CIRCLE" || true
done

bash

if cat ~/.pilot/circles/$CIRCLE.json | jq -e --arg h "$HOSTNAME" '.members[] | select(. == $h)' >/dev/null; then

bash

cat > ~/.pilot/circles/$CIRCLE.json <<EOF

Technical Analysis

The CIRCLE variable is inserted directly into filesystem paths without validation or shell quoting. A circle name containing path traversal sequences such as ../, or shell word-separation and glob characters, is therefore not constrained to ~/.pilot/circles.

For example, a value such as ../../target makes the destination resolve outside the intended circle directory. In the add-member workflow, mv may consequently replace another file writable by the current user. In the bootstrap workflow, traversal can cause the recipe to read an unintended JSON file and treat its contents as trusted agent membership data.

Because the paths are also unquoted, spaces and wildcard characters in CIRCLE can cause shell word splitting or pathname expansion. The documented static examples are safe, but the recipe becomes exploitable if a circle name is supplied by a user, automation pipeline, or other untrusted source.

Attack Path

1. An attacker obtains control over, or persuades the operator to use, a crafted circle name such as ../../target.
2. The agent or ...[truncated 1148 chars]

Remediation

View remediation

Remediation Suggestions

Validate circle names before using them in any path and quote every path expansion:

bash

case "$CIRCLE" in
  ''|*[!A-Za-z0-9_-]*)
    printf 'Invalid circle name\n' >&2
    exit 1
    ;;
esac

CIRCLE_DIR="$HOME/.pilot/circles"
CIRCLE_FILE="$CIRCLE_DIR/$CIRCLE.json"
mkdir -p -- "$CIRCLE_DIR"

Use only the validated CIRCLE_FILE variable afterward:

bash

jq --arg member "$NEW_MEMBER" '.members += [$member]' \
  "$CIRCLE_FILE" > "$TEMP_FILE"

Further hardening should include:

1. Rejecting /, \, .., whitespace, glob characters, and control characters.
2. Resolving or canonicalizing the final path and verifying that it remains beneath $HOME/.pilot/circles.
3. Quoting all variable expansions used as command arguments.
4. Using jq directly on files instead of unnecessary cat pipelines.
5. Requiring explicit operator confirmation before approving a node derived from mutable circle configuration.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:48

Finding

Predictable Shared Temporary File Enables Symlink and Race Attacks

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48-51
Vulnerability Type: Insecure temporary file creation
Risk Level: Medium

Vulnerable Code

bash

jq --arg member "$NEW_MEMBER" '.members += [$member]' \
  ~/.pilot/circles/$CIRCLE.json > /tmp/circle.json && \
  mv /tmp/circle.json ~/.pilot/circles/$CIRCLE.json

Technical Analysis

The recipe uses the fixed, globally predictable path /tmp/circle.json. Shared temporary directories can be accessed by other local users and processes. An attacker can attempt to create this path before the victim runs the command, including as a symbolic link to another file.

The shell opens the temporary path for output before jq executes. On systems that permit following the attacker-created symbolic link, the redirection can truncate and overwrite the link target using the victim's permissions. There is also a time-of-check/time-of-use window between writing the temporary file and moving it into the circle directory. Another process may attempt to replace or alter the temporary object during that interval.

Some operating systems enable protections against unsafe symlink following in sticky directories, which may reduce exploitability, but the recipe must not depend on platform-specific mitigations.

Attack Path

1. A local attacker predicts that the operator will use /tmp/circle.json.
2. Before the command runs, the attacker creates /tmp/circle.json as a symbolic link to a file writable by the victim, or races to replace the temporary object.
3. The shell processes the output redirection and opens the predictable path.
4. If symbolic-link protections do not block the operation, the linked target is truncated and receives the generated JSON.
5. The subsequent mv may also replace the intended circle configuration with an attacker-influenced object.
6. The result can be corruption of user-accessible files or compromise of the trust-circle configuration.

I

...[truncated 570 chars]

Remediation

View remediation

Remediation Suggestions

Create the temporary file securely with mktemp, preferably inside the destination directory so that the final rename remains on the same filesystem:

bash

CIRCLE_DIR="$HOME/.pilot/circles"
CIRCLE_FILE="$CIRCLE_DIR/$CIRCLE.json"
TEMP_FILE=$(mktemp "$CIRCLE_DIR/.circle.XXXXXX") || exit 1

cleanup() {
  rm -f -- "$TEMP_FILE"
}
trap cleanup EXIT HUP INT TERM

chmod 600 "$TEMP_FILE"

jq --arg member "$NEW_MEMBER" '.members += [$member]' \
  "$CIRCLE_FILE" > "$TEMP_FILE" || exit 1

mv -- "$TEMP_FILE" "$CIRCLE_FILE" || exit 1
trap - EXIT HUP INT TERM

Additionally:

1. Set a restrictive umask, such as umask 077, before creating trust configuration.
2. Ensure ~/.pilot and ~/.pilot/circles are owned by the executing user and are not writable by other users.
3. Do not reuse a common temporary filename across concurrent operations.
4. Validate the generated JSON before atomically replacing the existing configuration.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md

Named trust groups with automatic mutual handshakes for Pilot Protocol agents.

  Use this skill when:
  1. You need to create groups of mutually trusting agents (teams, projects)
  2. You want to bootstrap trust for new agents joining a group
  3. You need to manage multiple distinct trust circles simultaneously

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill operationalizes automatic trust establishment by initiating handshakes and approving peers with minimal verification, but it does not warn users that this grants durable trust relationships with potentially broad access implications. In the bootstrap flow, approval is based largely on hostname membership in a local JSON file, which can lead to trusting unintended or spoofed peers if identifiers are incorrect, stale, or attacker-controlled.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The workflow example shows creation and bootstrapping of a trust circle, normalizing persistent mutual trust as a convenience operation. In this context, the skill encourages durable trust relationships among multiple agents without embedding verification or approval safeguards, which can expand compromise blast radius if a member is malicious or impersonated.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

Workflow Example

Create and bootstrap a new trust circle:

bash

#!/bin/bash

Static analysis

No suspicious patterns detected.