Pilot Service Agents Packages

Package-registry metadata — npm, PyPI, Maven Central (Solr-backed). Use this skill when: 1. Checking a package's version, maintainer, dependencies 2. Queryin...

Security Scan

The skill's requirements and runtime instructions align with its stated purpose (querying package-registry metadata via the Pilot Protocol), and it does not request unexplained credentials or install anything on disk.

Purpose & Capability

Name/description ask for package-registry metadata and the skill only requires pilotctl and a running Pilot Protocol daemon on a specific network overlay — these are directly relevant to contacting the service-agents described. No unrelated credentials, binaries, or config paths are requested.

Instruction Scope

SKILL.md only instructs the agent to use pilotctl to send queries (/help, /data, /summary) and read the inbox; it explicitly states it is metadata-only and warns not to download artifacts. It does not instruct reading unrelated files or environment variables, nor sending data to off-channel endpoints.

Install Mechanism

There is no install specification and no code files — instruction-only. This is the lowest-risk install posture and matches the skill's stated runtime model (using an existing pilotctl binary).

Credentials

The skill requires no environment variables or credentials. The only runtime dependency is pilotctl and a joined daemon, which is proportional to the task of querying overlay agents for package metadata.

Persistence & Privilege

The skill is not marked always:true and does not request changes to other skills or system-wide settings. Autonomous invocation is allowed (platform default) but is not combined with broad or unexplained privileges.

Assessment

This skill is internally consistent: it needs pilotctl and a running Pilot Protocol daemon joined to network 9 so it can message service-agents that provide package metadata. Before installing, ensure you: 1) trust the pilotctl binary and obtained it from an official source, 2) understand that queries are sent over the Pilot overlay network (so avoid including secrets or sensitive code in queries), and 3) have or trust the required pilot-protocol core skill/daemon and the network overlay — those components handle the actual network traffic. The skill will not download package artifacts and requests no external credentials.

Package-registry metadata — npm, PyPI, Maven Central (Solr-backed).

All agents in this category follow the standard contract described in pilot-service-agents. Send /help to any agent to read its exact filter schema — the table below is a snapshot; the catalogue grows, so always verify with a fresh list-agents query.

Agents in this category (snapshot)

Hostname	Description
maven-solr	Maven Central Solr search
npm-package	npm package metadata
pypi-package	PyPI package metadata

What you can expect

• Unauthenticated queries to all three big language-ecosystem registries
• Structured responses suitable for dependency analysis

What NOT to expect

• Vulnerability scanning (use pilot-service-agents-security for CVE lookups)

Commands (same pattern for every agent in the category)

# Read an agent's filter contract
pilotctl --json send-message <hostname> --data "/help"
pilotctl --json inbox

# Fetch structured data
pilotctl --json send-message <hostname> --data '/data {json filters}'
pilotctl --json inbox

# Natural-language summary (Gemini)
pilotctl --json send-message <hostname> --data '/summary {json filters}'
pilotctl --json inbox

Response shape

send-message returns an ACK envelope immediately ({"ack":"ACK TEXT N bytes", "bytes":N, "target":"<address>", "type":"text"}). The actual agent response arrives a few seconds later and is read with pilotctl --json inbox. Each inbox entry carries the agent's normalised envelope in its data field:

{
  "source": "<hostname>",
  "items":  [...],
  "count":  <int>,
  "total":  <int|null>,
  "page":   <int|null>,
  "next":   <cursor|null>,
  "truncated": <bool>,
  "upstream_url": "<resolved upstream URL>"
}

/help returns plain text. /summary returns a Gemini-generated prose string. Free-text queries also return Gemini prose.

Workflow Example

# 1. Fresh discovery — the catalogue grows, never hard-code
pilotctl --json send-message list-agents --data '/data {"category":"packages","limit":20}'
pilotctl --json inbox

# 2. Read the contract of a specific agent
pilotctl --json send-message pypi-package --data '/help'
pilotctl --json inbox

# 3. Query it
pilotctl --json send-message pypi-package --data '/data {"package":"httpx"}'
pilotctl --json inbox

Dependencies

Requires the pilot-protocol core skill, the pilot-service-agents skill (for the general discovery flow), pilotctl on PATH, and a running daemon joined to network 9.