T08 · Insecure Dependencies
Error
- Location
SKILL.md:38- Finding
Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Pilot Video Production Pipeline Setup
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its advertised video-pipeline purpose, but needs review because it installs multiple unpinned skills, uses unsafe shell templates, and establishes agent trust with little verification.
Review this before installing in a real production or publishing environment. Use only trusted, pinned dependency versions; validate the deployment prefix as a hostname-safe value; confirm peer identities before handshakes; and explicitly approve any YouTube, TikTok, social, webhook, or Slack destinations and credentials used by the distributor role.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:34- Finding
Unsanitized User-Controlled Prefix Can Cause Shell Command Injection
- Content
View full analysis
- ``` ``` The same unquoted placeholder pattern is subsequently used in handshake, subscribe, and publish commands, including: ```bash pilotctl --json handshake -editor "setup: video-production-pipeline" pilotctl --json subscribe -scripter video-script pilotctl --json publish -editor video-script '{"title":"10 Tips for Productivity","duration_sec":480,"scenes":5}' ``` ### Technical Analysis The skill explicitly obtains the deployment prefix from the user and inserts it into Bash command templates. No validation rules are defined, and the substituted value is not shell-quoted. If an agent performs direct textual substitution and invokes the resulting command through a shell, shell metacharacters embedded in the prefix can alter command structure. Characters such as command separators, command substitutions, redirection operators, or newline characters may cause the shell to execute operations beyond the intended `pilotctl` invocation. For example, a malicious prefix conceptually shaped as `valid; ATTACKER_COMMAND; #` could terminate the intended argument, execute another command, and comment out the remaining template text. The exact payload need not be fixed because exploitation depends on h ...[truncated 1821 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The 'auto-approved -- no manual step needed' behavior describes an autonomous trust decision for a security-sensitive action. Even if intended for convenience, removing human confirmation from trust establishment increases the chance of accidental authorization, misconfiguration, or abuse by an impersonating agent in this distributed pipeline.
- Content
2. Establish trust
Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.
bash # On scripter:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README instructs operators to establish mutual trust between agents and states that trust becomes auto-approved with no manual verification step. In a multi-agent workflow that passes scripts, assets, and publishing events, this can lead to unintended pairing with the wrong host or a spoofed agent, enabling unauthorized data exchange or command flow once both handshakes are sent.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 83% confidence
- Finding
The skill persists a setup manifest under ~/.pilot/setups, creating durable local state that includes hostnames, peer relationships, data flows, and role assignments. While this is normal for setup automation, the persistence is not disclosed or scoped, which can leave potentially sensitive operational metadata on disk longer than the user expects and available to other local processes or users depending on filesystem permissions.
- Content
pilotctl --json set-hostname -
text **Step 4:** Write the setup manifest: ```bash mkdir -p ~/.pilot/setups cat > ~/.pilot/setups/video-production-pipeline.json << 'MANIFEST'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly configures a distributor role to send publish notifications to external platforms over port 443 and to post confirmations and summaries to Slack, but it does not instruct the operator to obtain informed user consent or warn that content and metadata will leave the local system. In an automation/setup skill, this omission is security-relevant because users may enable outbound integrations that transmit sensitive media, titles, metadata, or performance data to third parties without realizing it.
- Content
Static analysis
No suspicious patterns detected.