Pilot Event Log

Persistent NDJSON event logging with rotation, compression, and retention policies. Use this skill when: 1. You need persistent storage of event streams 2. Y...

Security Scan

The skill's requirements and instructions match its stated purpose (persistent NDJSON logging using pilotctl + jq); nothing requested is disproportionate or unrelated, but review runtime permissions and topic scope before deployment.

Purpose & Capability

Name/description, declared required binaries (pilotctl, jq), and the SKILL.md instructions all align: the skill subscribes to Pilot Protocol event streams and writes NDJSON logs with rotation/compression. The SKILL.md also declares the dependency on the pilot-protocol skill and the pilotctl daemon, which is coherent.

Instruction Scope

Instructions are focused on subscribing, appending events to ndjson files, rotating, compressing, and deleting old logs. This is within scope. Notes: the workflow writes to /var/log/pilot-events (system log path) which may require elevated privileges; the example subscribes to '*' (all topics), which could capture large volumes or sensitive events—consider scoping topics. The rotation one-liner in the Commands section uses date +%s twice and therefore gzips a filename that may not match the moved file (minor correctness bug).

Install Mechanism

Instruction-only skill with no install spec and no code files — lowest install risk. It relies on existing system tools (pilotctl, jq, gzip, find), which are reasonable for the declared functionality.

Credentials

No environment variables, no credentials, and no config paths are requested. The external tools required (pilotctl, jq, gzip) are appropriate and proportionate for reading and processing event streams.

Persistence & Privilege

always:false and no elevated platform privileges are requested by the skill. It does instruct writing logs to system directories and running a long-running loop (typical for logging daemons) but does not attempt to modify other skills or global agent configuration.

Assessment

This skill appears internally consistent: it uses pilotctl to subscribe to events and jq to format/store them. Before installing, verify: (1) pilotctl and the pilot daemon are trustworthy and up-to-date; (2) who owns /var/log/pilot-events and whether the agent will run with root or elevated privileges (writing to /var/log may require root); (3) whether you want to subscribe to all topics ('*')—limit to needed topics to avoid storing sensitive data or high volume; (4) retention/rotation commands will permanently delete old logs—confirm your retention policy and backup needs; (5) test the rotation snippet (the one-liner uses date twice and may gzip a nonexistent filename) and run in a sandbox first. If you’re concerned about autonomous agent invocation having write/network access, consider restricting the agent’s runtime permissions or running the logging loop under a dedicated service account.

Persistent NDJSON logging of Pilot Protocol event streams with rotation and compression.

Commands

Subscribe and Log

pilotctl --json subscribe <source> <topic> --timeout <seconds> | jq -c '.data.events[]' >> <log-file.ndjson>

Query by Time

jq -c --arg start "2026-04-08T00:00:00Z" --arg end "2026-04-08T23:59:59Z" \
  'select(.timestamp >= $start and .timestamp <= $end)' events.ndjson

Query by Topic

jq -c 'select(.topic | startswith("alerts."))' events.ndjson

Rotate Logs

[ "$(du -m "$log_file" | cut -f1)" -ge "$MAX_SIZE_MB" ] && mv "$log_file" "$log_file.$(date +%s)" && gzip "$log_file.$(date +%s)" &

Compress Old Logs

find /var/log/pilot-events -name "events-*.ndjson" -mtime +1 -exec gzip {} \;

Retention Cleanup

find /var/log/pilot-events -name "events-*.ndjson.gz" -mtime +90 -delete

Workflow Example

#!/bin/bash
# Production event logging

SOURCE="${1:-production-app}"
LOG_DIR="/var/log/pilot-events/$SOURCE"
MAX_SIZE_MB=500

mkdir -p "$LOG_DIR"
log_file="$LOG_DIR/current.ndjson"

while true; do
  pilotctl --json subscribe "$SOURCE" "*" --timeout 600 | jq -c '.data.events[]? // empty' | \
  while IFS= read -r event; do
    echo "$event" | jq -c '. + {logged_at: (now | todate)}' >> "$log_file"

    size_mb=$(du -m "$log_file" 2>/dev/null | cut -f1)
    if [ "${size_mb:-0}" -ge "$MAX_SIZE_MB" ]; then
      rotated="$LOG_DIR/events-$(date +%Y%m%d-%H%M%S).ndjson"
      mv "$log_file" "$rotated" && gzip "$rotated" &
    fi
  done
  sleep 5
done

Dependencies

Requires pilot-protocol skill, jq (1.6+), gzip, and running daemon.