Pilot Swarm Join

Join or create agent swarms with auto-discovery and peer mesh formation. Use this skill when: 1. An agent needs to join an existing swarm or create a new one...

Security Scan

The skill appears to do what it says (join/create swarms using pilotctl) but has inconsistent metadata (jq is used but not declared) and its runtime instructions include an automated, blind 'approve all pending' pattern that could grant trust to unverified peers — proceed with caution.

Purpose & Capability

Name/description align with the commands in SKILL.md: it uses pilotctl to publish/subscribe/discover/handshake/approve and therefore legitimately requires pilotctl and the pilot-protocol ecosystem. No unrelated services or credentials are requested.

Instruction Scope

Instructions remain within the stated purpose but contain risky, broad actions: examples show approving all pending nodes via 'pilotctl --json pending | jq -r ... | xargs ... approve', which will blindly trust any pending peer. The SKILL.md also assumes network access to a registry host and a running daemon; there is no guidance about verification or filters for approving peers. This grants the agent discretionary power to establish trust with unknown nodes if run as-is.

Install Mechanism

Instruction-only skill with no install spec or archive downloads. This is low-risk from an installation viewpoint: nothing is written to disk by the skill package itself.

Credentials

The skill declares no environment variables and no credentials, which is appropriate. However, the SKILL.md uses jq in multiple commands but the registry/metadata only lists pilotctl in required bins — jq is not declared in the openclaw metadata, which is an inconsistency that could break or misrepresent runtime requirements.

Persistence & Privilege

always is false and the skill is user-invocable; it does not request persistent system-level configuration or cross-skill config changes. Autonomous invocation is allowed by default but not combined with other high-privilege requests.

What to consider before installing

This skill performs swarm join/mesh actions with pilotctl and is coherent with its purpose, but you should not run the example commands blindly. Key considerations: - jq is used throughout but not declared in metadata; make sure jq is installed before using the skill. - The examples automatically approve all pending nodes. That behavior will establish trust with any pending peer and can let untrusted agents join your swarm. Replace blanket approve pipelines with explicit checks or manual approval steps. - Ensure the pilotctl daemon and registry host you connect to are trusted and that you understand what 'handshake' and 'approve' do in pilotctl (review pilotctl docs). - Run initial tests in an isolated environment or sandboxed agent before using in production to observe what peers are discovered and what data is transmitted in publish/handshake messages. - If you need stricter security, request that the skill include verification steps (e.g., signature checks, allowlist of node IDs, or manual approval prompts) instead of demonstrating unconditional approval. If you want, I can suggest a safer workflow (examples that filter/verify peers before calling approve) or produce a checklist of pilotctl commands to audit before running this skill.

Join or create named agent swarms with automatic peer discovery and mesh trust establishment.

Commands

Join Swarm

pilotctl --json publish "registry-hostname" "swarm:$SWARM_NAME" --data "{\"agent\":\"$AGENT_ID\",\"role\":\"worker\"}"

Subscribe to Swarm

pilotctl --json subscribe "registry-hostname" "swarm:$SWARM_NAME"

Discover Peers

PEERS=$(pilotctl --json inbox | jq -r '.messages[] | select(.topic == "swarm:'$SWARM_NAME'") | .sender')

Handshake with Peers

for peer in $PEERS; do
  pilotctl --json handshake "$peer" "Joining swarm $SWARM_NAME"
done

Approve Peers

pilotctl --json pending | jq -r '.[].node_id' | xargs -I {} pilotctl --json approve {}

Leave Swarm

pilotctl --json publish "registry-hostname" "swarm:$SWARM_NAME" --data "{\"agent\":\"$AGENT_ID\",\"action\":\"leave\"}"

Workflow Example

#!/bin/bash
# Join compute swarm

SWARM_NAME="compute-cluster-01"
AGENT_ID=$(pilotctl --json info | jq -r '.node_id')
REGISTRY_HOST="registry.example.com"

# Announce presence
pilotctl --json publish "$REGISTRY_HOST" "swarm:$SWARM_NAME" \
  --data "{\"agent\":\"$AGENT_ID\",\"role\":\"worker\",\"joined_at\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}"

# Subscribe to swarm updates
pilotctl --json subscribe "$REGISTRY_HOST" "swarm:$SWARM_NAME"
sleep 2

# Discover peers
PEERS=$(pilotctl --json inbox | jq -r '.messages[] | select(.topic == "swarm:'$SWARM_NAME'") | .payload.agent')

# Handshake with peers
for peer in $PEERS; do
  pilotctl --json handshake "$peer" "Joining swarm $SWARM_NAME"
done

# Approve handshakes
pilotctl --json pending | jq -r '.[].node_id' | xargs -I {} pilotctl --json approve {}

Dependencies

Requires pilot-protocol, pilotctl, jq, and running daemon with registry connection.