Pilot Task Template

Reusable task templates with placeholder substitution. Use this skill when: 1. You need to define common task patterns for reuse 2. You want parameterized ta...

Security Scan

The skill's purpose (template-based task creation and submission to pilotctl) is plausible and mostly consistent, but the runtime instructions reference and substitute arbitrary environment variables (not declared), omit a dependency (jq), and can cause accidental disclosure of secrets when templates reference sensitive env names.

Purpose & Capability

Name, description, and required binary (pilotctl) match the instructions: the SKILL.md shows how to build templates, substitute placeholders, and submit tasks via pilotctl. Requiring a pilot daemon and pilotctl is coherent for this purpose.

Instruction Scope

Runtime instructions read template files in ~/.pilot/templates, perform shell-based placeholder substitution, and call 'pilotctl --json task submit' which sends the instantiated task to the pilot system. The instructions perform indirect environment-variable expansion (${!VAR_NAME}) — meaning any placeholder like {{PASSWORD}} will read $PASSWORD — and will then submit that value to the network. The substitution/escaping is inconsistent (some examples escape values, others do not), increasing risk of malformed substitutions or injection-like behavior. The workflow also writes files into the user's home directory.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so nothing is written to disk by an installer. That is the lowest-risk install model.

Credentials

Registry metadata declares no required env vars, but the SKILL.md expects runtime variables (AGENT/AGENT_ADDR, MODEL, PROMPT, TEMPERATURE, TEMPLATE_NAME, etc.) and uses indirect expansion to read arbitrary env vars named by template placeholders. It also lists 'jq' as needed in the prose but does not declare it as a required binary. Reading arbitrary env vars without declaration can lead to accidental leakage of secrets if templates reference secret names.

Persistence & Privilege

The skill does not request always:true and does not modify other skills or system-wide configurations. It does create/require template files under ~/.pilot/templates which is a normal, limited persistence to the user's home directory.

What to consider before installing

This skill appears to do what it says (create templates and submit tasks via pilotctl), but before installing or using it you should: 1) Inspect any templates you plan to use — if a template contains placeholders that match secret environment variable names (e.g., PASSWORD, API_KEY), those values will be read from your environment and included in the submitted task. Avoid putting secrets in environment variables or remove sensitive placeholders from templates. 2) Note that SKILL.md refers to 'jq' but the skill metadata doesn't list it as a required binary—install and verify jq if you need JSON parsing. 3) Be cautious with untrusted templates: the substitution approach shown is brittle and inconsistent in escaping, so malformed variables can break substitutions or produce unexpected output. 4) Confirm you trust the pilotctl daemon and the target agent/network because instantiated tasks are sent out via 'pilotctl --json task submit'. If you need this functionality but want safer behavior, request that the skill explicitly declare required env vars, perform safe escaping of substitutions, and avoid indirect expansion of arbitrary env names (or provide an API to pass parameter values explicitly rather than reading environment variables).

Define reusable task templates with placeholder substitution. Enables standardized task patterns that can be instantiated with different parameters.

Essential Commands

Define template

cat > /tmp/ml-inference-template.txt <<'EOF'
Run ML inference using model {{MODEL}} with prompt: {{PROMPT}}, temperature {{TEMPERATURE}}
EOF

Substitute variables

TEMPLATE=$(cat /tmp/ml-inference-template.txt)

TASK_DESC=$(echo "$TEMPLATE" | \
  sed "s/{{MODEL}}/$MODEL/g" | \
  sed "s/{{PROMPT}}/$PROMPT/g" | \
  sed "s/{{TEMPERATURE}}/$TEMPERATURE/g")

Submit from template

pilotctl --json task submit "$AGENT_ADDR" --task "$TASK_DESC"

Template with defaults

MODEL=${MODEL:-"gpt-4"}
TEMPERATURE=${TEMPERATURE:-0.7}
MAX_TOKENS=${MAX_TOKENS:-100}

Template library

TEMPLATE_DIR="$HOME/.pilot/templates"
mkdir -p "$TEMPLATE_DIR"

# List templates
ls -1 "$TEMPLATE_DIR"/*.txt | sed 's|.*/||; s|\.txt$||'

# Load template
TEMPLATE=$(cat "$TEMPLATE_DIR/$TEMPLATE_NAME.txt")

Workflow Example

Template-based submission system:

#!/bin/bash
set -e

TEMPLATE_DIR="$HOME/.pilot/templates"
mkdir -p "$TEMPLATE_DIR"

# Define template
cat > "$TEMPLATE_DIR/image-generation.txt" <<'EOF'
Generate image using model {{MODEL}}: {{PROMPT}}, size {{WIDTH}}x{{HEIGHT}}
EOF

# Instantiate template
instantiate_template() {
  TEMPLATE=$(cat "$TEMPLATE_DIR/$1.txt")

  while IFS= read -r VAR; do
    VAR_NAME=$(echo "$VAR" | sed 's/[{}]//g')
    VAR_VALUE="${!VAR_NAME}"

    [ -z "$VAR_VALUE" ] && { echo "Error: $VAR_NAME required"; exit 1; }

    VAR_VALUE_ESCAPED=$(echo "$VAR_VALUE" | sed 's/[&/\]/\\&/g')
    TEMPLATE=$(echo "$TEMPLATE" | sed "s|{{$VAR_NAME}}|$VAR_VALUE_ESCAPED|g")
  done < <(echo "$TEMPLATE" | grep -o '{{[^}]*}}' | sort -u)

  echo "$TEMPLATE"
}

# Submit
export AGENT="0:1234.5678.9abc"
export MODEL="stable-diffusion-xl"
export PROMPT="futuristic cityscape"
export WIDTH=1024
export HEIGHT=1024

TASK_DESC=$(instantiate_template "image-generation")
TASK_ID=$(pilotctl --json task submit "$AGENT" --task "$TASK_DESC" | jq -r '.task_id')

echo "Task submitted: $TASK_ID"

Dependencies

Requires pilot-protocol skill, pilotctl binary, running daemon, jq for JSON parsing, and template files in ~/.pilot/templates/.