Pilot Announce Capabilities
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's requirements and instructions are coherent with its stated purpose (advertising capability manifests via pilotctl), with only minor omissions to address before trusting it.
This skill appears to do what it says: it uses pilotctl to publish capability manifests to the Pilot Protocol network. Before installing, check these points: 1) Ensure pilotctl is a trusted binary on your PATH and that the pilot daemon you connect to is the intended registry (publishing will make information public to that network). 2) The SKILL.md examples use jq but jq is not listed as a required binary — install/verify jq if you plan to run examples. 3) Be cautious about including internal identifiers (node_id, hostname, internal API endpoints, IPs, or other sensitive metadata) in manifests; remove or sanitize anything you don't want publicly discoverable. 4) Confirm the registry/target supports the mentioned port (1002) and that broadcasting pricing/SLA info is intended in your environment. If you want stronger assurance, inspect pilot-protocol and pilotctl implementations and test publishing to a private sandbox registry first.
SkillSpector
SkillSpector findings are pending for this release.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.