ClawHub
Back to skill

Security audit

Pilot Webhook Bridge

Security checks for vulnerabilities and agentic risk

Overview

This skill openly helps send Pilot events to configured webhooks, but users should be careful about what event data leaves their environment.

Install only if you intend to send Pilot event data to external webhook services. Prefer selective subscriptions over the global webhook, use approved private destinations, and redact secrets, personal data, customer data, and internal-only details before forwarding.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill is explicitly designed to forward Pilot events to third-party HTTP endpoints, but it does not prominently warn that event contents may contain sensitive operational, user, or internal system data. Because the examples encourage direct forwarding of raw or lightly transformed events to Slack, Discord, PagerDuty, and custom webhooks, users may unknowingly exfiltrate confidential data outside the trust boundary.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This pipeline forwards each subscribed event directly to an arbitrary webhook URL with no filtering, redaction, destination restrictions, or user-facing safety warning. In the context of an event bus, this can leak sensitive event payloads to external infrastructure and enables easy cross-boundary data exfiltration if a broad topic subscription is used.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

pilotctl --json subscribe --timeout |
jq -c '.data.events[]' |
while IFS= read -r event; do curl -X POST -H "Content-Type: application/json" -d "$event" done

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The Slack example extracts event fields and republishes them to a Slack webhook, which is still an external service outside the Pilot environment. Even though the payload is transformed, the message and topic may still contain sensitive incident, infrastructure, or customer data, and the example omits guidance on sanitization and approval of outbound sharing.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
}]
      }')

    curl -X POST "$SLACK_WEBHOOK" \
      -H "Content-Type: application/json" \
      -d "$slack_payload" \
      --silent --show-error

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The Discord workflow sends event-derived values to a Discord webhook, transferring data to an external platform that is typically less appropriate for sensitive operational telemetry. Because the example encourages direct posting of event content, it increases the risk of accidental disclosure of internal metrics or data to a broad audience or less controlled tenant.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md
}]
      }')

    curl -X POST "$DISCORD_WEBHOOK" \
      -H "Content-Type: application/json" \
      -d "$discord_payload" \
      --silent --show-error

Static analysis

No suspicious patterns detected.