Security audit

OnePilot CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but it gives backend responses and hidden/custom CLI options too much control over sensitive data flow and agent output.

Install only if you trust the OnePilot publisher and backend. Avoid using custom --supabase-url values, review any agent-written recommendation or email before sending, do not ask it to download QR images from arbitrary URLs or into important file paths, and require explicit confirmation for application submissions, organizer changes, memory writes, feedback, issue reports, and registration exports.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: scripts/onepilot-agent.mjs:525
Finding: Mandatory Promotional and Remotely Controlled Output Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/onepilot-agent.mjs:791
Finding: Arbitrary URL Fetch and User-Writable File Overwrite in QR Downloader
Content: View full analysis
5_000_000) throw new Error("qr_image_too_large"); const buffer = Buffer.from(await response.arrayBuffer()); if (buffer.byteLength > 5_000_000) throw new Error("qr_image_too_large"); const contentType = response.headers.get("content-type") || ""; if (contentType && !contentType.toLowerCase().startsWith("image/")) throw new Error("qr_url_not_image"); const output = String(args.output || "").trim(); const outputPath = output ? path.resolve(output) : path.join(os.tmpdir(), `onepilot-event-group-qr-${Date.now()}${imageExtension(contentType, rawUrl)}`); fs.mkdirSync(path.dirname(outputPath), { recursive: true }); fs.writeFileSync(outputPath, buffer); return { ok: true, imagePath: outputPath, contentType: contentType || "image/*", bytes: buffer.byteLength, instruction: "Send imagePath as an inline image or image attachment to the user. If the current channel cannot send local images, fall back to the original URL.", fallbackUrl: rawUrl, }; } ``` ### Technical Analysis The QR downloader accepts any HTTP or HTTPS URL without restricting the hostname, ...[truncated 2577 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/onepilot-agent.mjs:385
Finding: Unvalidated Backend Override Can Redirect Sensitive OnePilot Data
Content: View full analysis
({})); if (!response.ok || payload.ok === false) { const error = new Error(String(payload.error || response.statusText || "request_failed")); error.status = response.status; error.payload = payload; throw error; } return payload; } async function bind(args) { const code = String(args.code || "").trim().toUpperCase(); if (!/^OPB-[A-F0-9]{12}$/.test(code)) { throw new Error("invalid_binding_code_format"); } const supabaseUrl = String(args["supabase-url"] || DEFAULT_SUPABASE_URL).replace(/\/+$/, ""); const result = await postJson(`${supabaseUrl}/functions/v1/agent-bind`, { code, agentName: String(args["agent-name"] || "Codex").trim().slice(0, 80) || "Codex", }); if (!result.agentToken) throw new Error("missing_agent_token_in_response"); const config = { supabaseUrl, agentToken: result.agentToken, label: result.label || args["agent-name"] || "Codex", scopes: result.scopes || [], boundAt: new Date().toISOString(), }; writeConfig(config); return safeConfigSummary(config); } ``` ```js async function bindEmail(args) { const mode = args._[1] || "start"; ...[truncated 4112 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (42)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 332)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Static analysis

No suspicious patterns detected.