Pilot Chunk Transfer
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's behavior matches its stated purpose (chunked file transfer over the Pilot protocol) but the SKILL.md lists additional runtime dependencies and contains incomplete/underspecified steps you should review before using it in production.
This skill appears to do what it says (chunked file transfers over the Pilot protocol), but check a few things before you install/use it: 1) Confirm pilotctl and the Pilot daemon are trusted and expected on your system. 2) Ensure the additional runtime tools the SKILL.md uses (jq, dd, md5sum, bc) are available — the registry metadata should list them but does not. 3) Review/complete the receive path: the SKILL.md mentions verifying per-chunk hashes but doesn't show where received chunk files are written or how verification is enforced; add explicit verification before reassembly. 4) Test with non-sensitive/sample files to validate resume and integrity behavior. 5) Be aware the scripts create temp files in /tmp and store received chunks under $HOME/.pilot — if that location is sensitive, change it. If you need higher assurance, request the publisher to update the skill metadata to declare all required binaries and to provide a complete, robust receive/verification implementation.
SkillSpector
SkillSpector findings are pending for this release.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.