Pilot Incident Response Setup

Deploy an incident response pipeline with 4 agents. Use this skill when: 1. User wants to set up automated incident detection and response 2. User is configu...

Security Scan

The skill's requirements and instructions match its stated purpose (deploying a 4-agent incident response pipeline), but it delegates installation to external packages (via clawhub) and omits details about credentials for notification bridges — review those downstream installs before trusting them.

Purpose & Capability

Name/description (incident response pipeline) align with required binaries (pilotctl, clawhub) and the SKILL.md steps (install skills, set hostnames, handshake). Nothing requested appears unrelated to the stated purpose.

Instruction Scope

SKILL.md stays within setup scope (install skills for each role, write a manifest to ~/.pilot/setups/incident-response.json, initiate handshakes, use pilotctl to publish). It does instruct creating network trust between agents (handshakes) and installing bridges that will connect to external services; the doc does not document how those external credentials are supplied or validated.

Install Mechanism

This is instruction-only (no install spec). The risk comes from delegating installs to clawhub (clawhub install …) which will fetch and install many pilot-* skills — the skill itself does not declare where those packages are sourced or how clawhub verifies them.

Credentials

The skill declares no environment variables or credentials, which is consistent for a generic setup script. However, several referenced bridge skills (Slack, email, webhook, PagerDuty/Opsgenie via webhook) will almost certainly require tokens/credentials; SKILL.md does not explain how those are provisioned or stored, so credential collection happens out-of-band and should be audited.

Persistence & Privilege

always:false and no system-wide privilege requests. The skill instructs writing a manifest under the user's home (~/.pilot/setups/incident-response.json), which is appropriate for per-user configuration and within scope.

Assessment

This skill is coherent for setting up a 4-agent incident-response pipeline, but it delegates actual package installation to clawhub and to many pilot-* bridge components. Before installing: (1) verify clawhub and pilotctl are the official tools you expect and trust; (2) inspect the pilot-* packages clawhub will fetch (sources, checksums, or package registry) — bridges (Slack, email, webhook) will need credentials and can forward alerts externally; (3) be cautious when performing the automatic handshakes as they create mutual trust between agents and can allow data flow; (4) check permissions on ~/.pilot/setups/incident-response.json and consider running initial deployments in an isolated environment. If you need a tighter security review, provide the list of specific pilot-* packages (or the clawhub install output) so those can be inspected.

Incident Response Setup

Deploy 4 agents: detector, triage, remediator, and notifier.

Roles

Role	Hostname	Skills	Purpose
detector	<prefix>-detector	pilot-watchdog, pilot-alert, pilot-audit-log, pilot-metrics	Monitors for anomalies
triage	<prefix>-triage	pilot-alert, pilot-event-filter, pilot-priority-queue, pilot-sla	Classifies and routes incidents
remediator	<prefix>-remediator	pilot-task-router, pilot-cron, pilot-audit-log, pilot-quarantine	Executes automated fixes
notifier	<prefix>-notifier	pilot-slack-bridge, pilot-email-bridge, pilot-webhook-bridge, pilot-audit-log	Notifies humans

Setup Procedure

Step 1: Ask the user which role this agent should play and what prefix to use.

Step 2: Install the skills for the chosen role:

# For detector:
clawhub install pilot-watchdog pilot-alert pilot-audit-log pilot-metrics
# For triage:
clawhub install pilot-alert pilot-event-filter pilot-priority-queue pilot-sla
# For remediator:
clawhub install pilot-task-router pilot-cron pilot-audit-log pilot-quarantine
# For notifier:
clawhub install pilot-slack-bridge pilot-email-bridge pilot-webhook-bridge pilot-audit-log

Step 3: Set the hostname and write the manifest to ~/.pilot/setups/incident-response.json.

Step 4: Tell the user to initiate handshakes.

Manifest Templates Per Role

detector

{
  "setup": "incident-response", "role": "detector", "role_name": "Anomaly Detector",
  "hostname": "<prefix>-detector",
  "skills": {
    "pilot-watchdog": "Monitor for unusual traffic, error spikes, resource exhaustion.",
    "pilot-alert": "Emit structured anomaly alerts to triage.",
    "pilot-audit-log": "Log all detected anomalies for forensics.",
    "pilot-metrics": "Track detection rates, false positive ratios."
  },
  "data_flows": [{ "direction": "send", "peer": "<prefix>-triage", "port": 1002, "topic": "anomaly-detected", "description": "Raw anomaly alerts" }],
  "handshakes_needed": ["<prefix>-triage"]
}

triage

{
  "setup": "incident-response", "role": "triage", "role_name": "Incident Triage",
  "hostname": "<prefix>-triage",
  "skills": {
    "pilot-alert": "Receive raw alerts, classify severity (P1-P4).",
    "pilot-event-filter": "Filter noise and duplicates.",
    "pilot-priority-queue": "Queue incidents by priority for routing.",
    "pilot-sla": "Apply SLA policies to determine response deadlines."
  },
  "data_flows": [
    { "direction": "receive", "peer": "<prefix>-detector", "port": 1002, "topic": "anomaly-detected", "description": "Raw alerts" },
    { "direction": "send", "peer": "<prefix>-remediator", "port": 1002, "topic": "incident-action", "description": "Actionable incidents" },
    { "direction": "send", "peer": "<prefix>-notifier", "port": 1002, "topic": "incident-alert", "description": "Classified incidents" }
  ],
  "handshakes_needed": ["<prefix>-detector", "<prefix>-remediator", "<prefix>-notifier"]
}

remediator

{
  "setup": "incident-response", "role": "remediator", "role_name": "Auto-Remediator",
  "hostname": "<prefix>-remediator",
  "skills": {
    "pilot-task-router": "Execute remediation actions (restart, scale, quarantine).",
    "pilot-cron": "Run scheduled health checks.",
    "pilot-audit-log": "Log all remediation actions.",
    "pilot-quarantine": "Isolate compromised nodes."
  },
  "data_flows": [
    { "direction": "receive", "peer": "<prefix>-triage", "port": 1002, "topic": "incident-action", "description": "Actionable incidents" },
    { "direction": "send", "peer": "<prefix>-notifier", "port": 1002, "topic": "remediation-complete", "description": "Remediation reports" }
  ],
  "handshakes_needed": ["<prefix>-triage", "<prefix>-notifier"]
}

notifier

{
  "setup": "incident-response", "role": "notifier", "role_name": "Human Notifier",
  "hostname": "<prefix>-notifier",
  "skills": {
    "pilot-slack-bridge": "Post incident alerts to Slack channels.",
    "pilot-email-bridge": "Send escalation emails for P1 incidents.",
    "pilot-webhook-bridge": "Trigger external integrations (PagerDuty, Opsgenie).",
    "pilot-audit-log": "Log all notifications sent."
  },
  "data_flows": [
    { "direction": "receive", "peer": "<prefix>-triage", "port": 1002, "topic": "incident-alert", "description": "Classified incidents" },
    { "direction": "receive", "peer": "<prefix>-remediator", "port": 1002, "topic": "remediation-complete", "description": "Remediation reports" }
  ],
  "handshakes_needed": ["<prefix>-triage", "<prefix>-remediator"]
}

Data Flows

• detector → triage : raw anomaly alerts (port 1002)
• triage → remediator : actionable incidents (port 1002)
• triage → notifier : classified incidents (port 1002)
• remediator → notifier : remediation reports (port 1002)

Workflow Example

# On detector:
pilotctl --json publish <prefix>-triage anomaly-detected '{"source":"web-01","type":"error_spike","rate":450}'
# On triage:
pilotctl --json publish <prefix>-remediator incident-action '{"id":"INC-2847","severity":"P1","action":"restart_service"}'
pilotctl --json publish <prefix>-notifier incident-alert '{"id":"INC-2847","severity":"P1","summary":"Error spike on web-01"}'
# On remediator:
pilotctl --json publish <prefix>-notifier remediation-complete '{"id":"INC-2847","action":"restart_service","result":"success"}'

Dependencies

Requires pilot-protocol skill, pilotctl binary, clawhub binary, and a running daemon.