Pilot Reputation
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This instruction-only skill is broadly aligned with Pilot Protocol reputation analytics, but users should notice that it uses Bash, stores local peer snapshots, and includes an optional continuous tracking loop.
This skill appears safe to install as an instruction-only analytics helper, but treat its Bash snippets as commands that can create persistent local data. Only run the continuous tracking loop intentionally, protect or delete collected snapshots as needed, and make sure required tools such as pilotctl and jq come from trusted sources.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If invoked, the agent can run local shell commands that read Pilot data and create files in the user's home directory.
The skill gives the agent Bash-based workflows for calling pilotctl, jq, find, and file redirection. This is expected for the stated analytics purpose, but it means the user should review shell commands before running them.
allowed-tools: - Bash
Run the commands only for intended reputation-tracking tasks and review any Bash command before approving execution.
Local reputation snapshots may reveal peer relationships, hostnames, addresses, and score history to anyone with access to the user's files.
The snapshot command persists local agent identity details and peer reputation data. This is aligned with reputation trend tracking, but it creates a stored local history of network information.
"local_agent": $(pilotctl --json info | jq '{hostname, address, polo_score}'),
"peers": $(pilotctl --json peers)Store snapshots in a protected location, delete old data when no longer needed, and avoid collecting peer data if it is sensitive.
A continuously running tracker can accumulate files over time and keep collecting peer data until stopped.
The workflow example is a long-running collection loop. It is disclosed and purpose-aligned, but it can continue writing snapshots indefinitely if the user runs it.
while true; do
cat > "$REPO_DIR/data/snapshot-$(date +%s).json" <<EOF
{"timestamp":"$(date -u +%Y-%m-%dT%H:%M:%SZ)","peers":$(pilotctl --json peers)}
EOF
sleep 300
doneRun the continuous workflow only when needed, monitor it, stop it explicitly, and consider adding retention limits or scheduled cleanup.
The skill may fail or prompt ad hoc installation of missing tools if jq or bc are not already present.
SKILL.md documents dependencies beyond pilotctl, while the registry requirements only declare pilotctl. This is not malicious, but users may need undeclared local tools.
Requires pilot-protocol, pilotctl, jq, and bc.
Install any missing dependencies from trusted sources and prefer metadata that fully declares required binaries.