ClawHub
Back to skill

Security audit

OnePilot CLI

Security checks across malware telemetry and agentic risk

Overview

OnePilot is a disclosed local CLI skill for connecting an agent to OnePilot, with account binding, event recommendations, consent-based memory, and organizer workflows that generally match its stated purpose.

Review this skill as a cloud-connected account integration. Install it only if you are comfortable binding your OnePilot account to the local agent, storing a token under ~/.config/onepilot/agent.json, and sending selected recommendation, memory, application, feedback, issue-report, or organizer data to OnePilot when you approve those workflows. On shared machines, protect or remove the local token when finished, and be cautious with custom QR download output paths or organizer registration exports because they can contain personal data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The QR download path fetches attacker-controlled remote content and writes it to a local file path automatically, including a caller-supplied --output path, without any consent prompt or stronger path restrictions in this code path. In an agent context, that creates a local side effect the user may not expect and could be abused to drop untrusted files on disk or overwrite user-chosen locations if the agent is induced to invoke this command.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The binding flow persists an agent bearer token to ~/.config/onepilot/agent.json, creating a reusable local credential, but this path does not provide any user-facing notice that authentication state will be stored on disk. In a multi-user or shared-host agent environment, silent credential persistence increases the risk of unintended reuse or token exposure through local compromise, backups, or operator misunderstanding.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.