Pilot Review
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's behavior matches its stated purpose (a peer-review workflow using the pilotctl CLI) and is instruction-only, but there are small inconsistencies and operational risks you should verify before installing.
This skill is instruction-only and implements the advertised peer-review workflow using the pilotctl CLI and jq. Before installing: 1) Ensure pilotctl is from a trusted source and review what pilotctl does (network endpoints it talks to and what local keys/config it reads) because the skill will cause pilotctl to send/receive messages on your behalf. 2) Install jq (the SKILL.md depends on jq but the metadata omitted it). 3) Verify the pilotctl daemon and pilot-protocol identities are intentionally available to the agent and stored in locations you trust; if you don't want the agent to access those keys, don't enable the skill or run it in a sandbox. 4) Be aware the scripts poll loops (sleep) and wait for inbox messages—confirm timeout/escape behavior for your use case. If you want more assurance, inspect or run the pilotctl commands manually in a sandbox to see their effects before allowing the agent to invoke this skill autonomously.
SkillSpector
SkillSpector findings are pending for this release.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.