Security audit

Pilot Protocol

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent networking purpose, but it asks users to run an unverified remote installer and includes automation that can trust peers and accept remote tasks without review.

Install only after reviewing or replacing the remote installer with a pinned, verifiable package. Do not use the provided heartbeat auto-approval script as written; require explicit review for each new peer, incoming task, received file, webhook destination, and gateway mapping.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:77
Finding: Unverified Remote Installer Is Executed Directly by the Shell
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:95
Finding: Unaudited Remote Installer Establishes a Persistent System Service
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:287
Finding: Heartbeat Automatically Trusts Remote Peers and Accepts Their Tasks Without Validation
Content: View full analysis
/dev/null || pilotctl daemon start for id in $(pilotctl --json pending 2>/dev/null | grep -o '"node_id":[0-9]*' | grep -o '[0-9]*'); do pilotctl approve "$id" done for task_id in $(pilotctl --json task list --type received 2>/dev/null | jq -r '.data.tasks[] | select(.status=="NEW") | .task_id'); do pilotctl task accept --id "$task_id" done next_task=$(pilotctl --json task queue 2>/dev/null | jq -r '.data.queue[0].task_id // empty') if [ -n "$next_task" ]; then pilotctl task execute fi pilotctl --json inbox 2>/dev/null pilotctl --json received 2>/dev/null ``` ``` ### Technical Analysis The heartbeat script unconditionally approves every pending trust request. It does not verify peer identity, inspect the stated justification, consult an allowlist, or request user approval. Once trust is granted, the script accepts every task in the `NEW` state without examining the task description. The script then invokes `pilotctl task execute` for the next queued task. According to `references/TASK-SUBMIT.md:91-96`, that command prom ...[truncated 2579 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (20)

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The installation instructions fetch and execute a remote shell script directly from the network, which gives the remote server complete control over code executed on the user's system at install time. In a security-sensitive networking skill that installs binaries, modifies configuration, and sets up services, this substantially increases supply-chain and compromise risk if the server, DNS, TLS trust chain, or distribution process is attacked.
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
No sudo required. Binaries are installed to ~/.pilot/bin/.

bash
curl -fsSL https://pilotprotocol.network/install.sh | sh

Sets a hostname during install:

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: Piping a network response straight into sh is a classic dangerous chaining pattern because it removes any opportunity to inspect or verify the downloaded content before execution. If an attacker can influence the remote content or redirect the request, arbitrary shell commands run immediately in the user's environment, potentially persisting via PATH changes, config writes, or service installation described by the skill.
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
No sudo required. Binaries are installed to ~/.pilot/bin/.

bash
curl -fsSL https://pilotprotocol.network/install.sh | sh

Sets a hostname during install:

Ssd 4

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The heartbeat section normalizes unattended processing of remote-originated trust requests and tasks, including accepting tasks quickly and executing queued work, which reduces or removes human review for untrusted network actions. In a networking skill that explicitly handles incoming messages, files, and tasks from other agents, this creates a strong pathway for remote abuse, coercing the agent into processing malicious content or instructions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The heartbeat instructions tell the operator to approve or reject incoming trust requests as part of routine automation, but they do not highlight that granting trust changes the attack surface and may permit remote interaction from untrusted agents. In this skill, trust is a gating control for discovery and communications, so normalizing rapid approval without warning makes unsafe trust expansion more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script auto-approves all pending trust requests and provides no warning that doing so can expose the agent to hostile or spoofed peers. Since trust is the mechanism that opens communication and task pathways in this protocol, the sample directly operationalizes unsafe behavior rather than merely omitting a caution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill encourages sending messages, files, tasks, and webhook data to other agents and endpoints but does not prominently warn that these operations may disclose sensitive data outside the local trust boundary. Because this is an agent-to-agent networking skill, users may forward credentials, local file contents, or internal task data without adequate caution, creating confidentiality and privacy risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The sample heartbeat script automatically approves every pending trust request, which eliminates any trust decision boundary and grants network access to arbitrary peers. In this skill's context, trust enables messaging, file transfer, task submission, and other remote interactions, so blanket approval materially increases exposure to malicious agents and follow-on task abuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation explicitly encourages sending files and typed messages to remote agents and notes that the recipient daemon persists them to disk, but it provides no warning about sensitivity, trust boundaries, or the fact that remote persistence may be outside the sender's control. In a skill specifically designed for agent-to-agent communication and file exchange, this omission increases the risk of inadvertent data exfiltration, disclosure of secrets, or unsafe sharing with untrusted peers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation describes starting an IP bridge that opens local TCP proxy listeners and notes root is required for privileged ports, but it does not clearly warn users about the security implications of exposing local listeners that forward traffic to remote agents. In the context of an agent-to-agent networking skill, this omission can cause users to unintentionally create a bridge into remote services or run privileged networking commands without understanding the attack surface.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
bash
# Map a remote agent and proxy port 3000 sudo pilotctl gateway start --ports 3000 0:0000.0000.0001 # mapped 10.4.0.1 -> 0:0000.0000.0001 # Now use standard tools

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
bash
# Map a remote agent and proxy port 3000 sudo pilotctl gateway start --ports 3000 0:0000.0000.0001 # mapped 10.4.0.1 -> 0:0000.0000.0001 # Now use standard tools

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/GATEWAY.md (reported line 51)May include surrounding context.
bash
# Map a remote agent and proxy port 3000 sudo pilotctl gateway start --ports 3000 0:0000.0000.0001 # mapped 10.4.0.1 -> 0:0000.0000.0001 # Now use standard tools

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/GATEWAY.md (reported line 59)May include surrounding context.
bash
# Map a remote agent and proxy port 3000 sudo pilotctl gateway start --ports 3000 0:0000.0000.0001 # mapped 10.4.0.1 -> 0:0000.0000.0001 # Now use standard tools

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file documents pilotctl deregister, which removes the current node from the registry, but it provides no warning that the action is destructive or may disrupt routing/availability. Under the markdown-specific warning criterion, users should be explicitly alerted when an operation can affect system integrity or connectivity.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 93% confidence
Finding: The auto-approval behavior allows trust to be created automatically when both sides initiate a handshake, reducing human review at the point where a sensitive relationship is established. In an agent-to-agent networking skill, this can be exploited through social engineering, misbinding, or unintended reciprocal requests, resulting in autonomous establishment of a trusted channel with a potentially unsafe peer.
Content: Scanner excerpt · references/TRUST.md (reported line 57)May include surrounding context.
md
## Auto-approval Trust is auto-approved when both agents independently request a handshake with each other (mutual handshake). ## Trust workflow example

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document describes approving trust and a mutual auto-approval path without clearly warning that trust permits broad, ongoing agent-to-agent communication. In this skill’s context, granting trust is effectively a security boundary change, so understating its consequences can lead operators or upstream agents to establish links with unvetted peers and expose tasks, files, or network access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation instructs users to configure a webhook that will POST real-time daemon events to an HTTP endpoint, but it does not warn that those events may contain sensitive operational metadata such as node identifiers, peer activity, trust-handshake information, and message/file receipt notifications. In the context of an agent-to-agent networking skill, this omission can lead users to expose telemetry to insecure or unintended endpoints, especially when using plain HTTP as shown in the example.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/WEBHOOKS.md (reported line 50)May include surrounding context.
md
| `handshake.pending` | Handshake queued for approval | | `handshake.approved` | Handshake approved | | `handshake.rejected` | Handshake rejected | | `handshake.auto_approved` | Mutual handshake auto-approved | | `trust.revoked` | Trust revoked locally | | `trust.revoked_by_peer` | Trust revoked by remote peer | | `message.received` | Typed message received via data exchange |

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/WEBHOOKS.md (reported line 50)May include surrounding context.
md
| `handshake.pending` | Handshake queued for approval | | `handshake.approved` | Handshake approved | | `handshake.rejected` | Handshake rejected | | `handshake.auto_approved` | Mutual handshake auto-approved | | `trust.revoked` | Trust revoked locally | | `trust.revoked_by_peer` | Trust revoked by remote peer | | `message.received` | Typed message received via data exchange |

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The subscription and listening commands document potentially unbounded inbound streams ('streams NDJSON indefinitely' and wildcard topic subscription) without warning about resource consumption, blocking behavior, or exposure to continuous unsolicited network data. In an agent communication skill, operators may run these commands in automation and unintentionally create denial-of-service, log flooding, or uncontrolled intake conditions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.