Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Pilot Gossip

v1.0.0

Gossip protocol for eventually-consistent shared state propagation across swarms. Use this skill when: 1. You need eventually-consistent state replication wi...

0· 88·0 current·0 all-time
byCalin Teodor@teoslayer

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for teoslayer/pilot-gossip.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Pilot Gossip" (teoslayer/pilot-gossip) from ClawHub.
Skill page: https://clawhub.ai/teoslayer/pilot-gossip
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: pilotctl
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install pilot-gossip

ClawHub CLI

Package manager switcher

npx clawhub@latest install pilot-gossip
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description describe gossip-based state replication and the SKILL.md uses pilotctl to enumerate peers and send/receive gossip messages — this aligns with the stated purpose. Declaring pilotctl and pilot-protocol as requirements is appropriate.
!
Instruction Scope
The instructions run pilotctl commands and shell pipelines that reference environment variables (SWARM_NAME, STATE_DATA, STATE_VERSION, AGENT_ID, MY_STATE, MY_VERSION) which are not declared in requires.env. The scripts also parse and forward message payloads and construct JSON payloads sent to peers; that means any data in the agent's state will be broadcast. The instructions do not read unrelated system files, but their scope with respect to environment variables and what gets broadcast is broader than the metadata describes.
Install Mechanism
This is an instruction-only skill with no install spec and no code files — nothing is written to disk. That is the lowest-risk install pattern and matches the file manifest.
Credentials
The skill declares no required environment variables or credentials, which is consistent with metadata. However, the runtime snippets assume several environment/runtime variables will be set and will be embedded in messages sent to other peers. Because gossip broadcasts arbitrary state, any secrets or sensitive data present in those variables would be propagated to peers — a proportionality/privacy concern to consider before use.
Persistence & Privilege
always is false and the skill does not request persistent or cross-skill configuration changes. It does not modify other skills or system-wide settings in its instructions.
What to consider before installing
This skill appears to implement gossip-style state propagation as described, but inspect and address these issues before installing: - Ensure pilotctl is installed and the pilot daemon is running (the SKILL.md requires pilotctl). The skill also uses jq, shuf, and base64 in its examples — install those or update the skill metadata to list them as required binaries. - The scripts reference environment/runtime variables (SWARM_NAME, STATE_DATA, STATE_VERSION, AGENT_ID, MY_STATE, MY_VERSION) that are not declared. Decide how those will be provided and verify they don't contain secrets. - Gossip semantics mean any data placed into the published state will be sent to random peers. Do not use this skill to replicate secrets or sensitive information unless you fully trust the swarm and have encryption/ACLs in place. - Test in an isolated/staging swarm first to confirm behavior and that peer addressing/search (pilotctl --search) is correct for your environment. - If you want higher assurance, ask the author to: (1) add jq/shuf/base64 to required binaries in metadata, (2) document which env vars are required and their expected format, and (3) include safety guidance on sensitive data handling.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Binspilotctl
latestvk975jw1x3hzt2z12vm7hpx8qs184hex5
88downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

pilot-gossip

Implement gossip protocols for eventually-consistent state propagation in agent swarms.

This skill enables agents to share state updates by randomly selecting peers and exchanging information, achieving eventual consistency without centralized coordination.

Commands

Publish state update to random peers

FANOUT=3
PEERS=$(pilotctl --json peers --search "swarm:$SWARM_NAME" | jq -r '.[].address' | shuf -n $FANOUT)

for peer in $PEERS; do
  pilotctl --json send-message "$peer" \
    --data "{\"type\":\"gossip_push\",\"version\":$STATE_VERSION,\"state\":$STATE_DATA,\"sender\":\"$AGENT_ID\",\"timestamp\":\"$(date -u +%s)\"}" &
done
wait

Merge received state updates

GOSSIP_MSGS=$(pilotctl --json received | jq '[.messages[] | select(.payload.type == "gossip_push")]')

for msg in $(echo "$GOSSIP_MSGS" | jq -r '.[] | @base64'); do
  PAYLOAD=$(echo "$msg" | base64 -d)
  REMOTE_VERSION=$(echo "$PAYLOAD" | jq -r '.payload.version')

  if [ "$REMOTE_VERSION" -gt "$MY_VERSION" ]; then
    MY_STATE=$(echo "$MY_STATE $REMOTE_STATE" | jq -s '.[0] * .[1]')
    MY_VERSION=$REMOTE_VERSION
  fi
done

Workflow Example

Distributed key-value store with gossip replication:

#!/bin/bash
SWARM_NAME="kv-store-cluster"
AGENT_ID=$(pilotctl --json info | jq -r '.node_id')

# Gossip loop
for round in $(seq 1 10); do
  # Push to random peers
  PEERS=$(pilotctl --json peers --search "swarm:$SWARM_NAME" | jq -r '.[].address' | shuf -n 3)

  for peer in $PEERS; do
    pilotctl --json send-message "$peer" \
      --data "{\"type\":\"gossip_push\",\"version\":$MY_VERSION,\"state\":$MY_STATE,\"sender\":\"$AGENT_ID\"}" &
  done
  wait

  sleep 5
done

Dependencies

Requires pilot-protocol skill, jq, shuf, and base64.

Comments

Loading comments...