Pilot Service Agents Dev

Developer-platform metadata — GitHub, Docker Hub, crates.io, and other ecosystem registries. Use this skill when: 1. Resolving a GitHub repo or fetching its...

Security Scan

The skill is internally consistent with its stated purpose — it is an instruction-only wrapper that uses the pilotctl client and a running pilot daemon to query public developer metadata; it does not request unrelated credentials or perform unexpected installs.

Purpose & Capability

The name and description claim read-only developer-platform metadata (GitHub, Docker Hub, crates.io, etc.). The skill only requires pilotctl and a running pilot-protocol daemon joined to a specific overlay network, which is coherent because the skill delegates lookups to remote 'service agents' over the Pilot network.

Instruction Scope

SKILL.md instructs the agent to send messages with pilotctl to discovery and per-host agents (/help, /data, /summary) and then read replies from pilotctl --json inbox. All referenced actions are read-only and limited to public metadata; there are no instructions to read local user files, credentials, or to transmit data to third-party endpoints outside the Pilot overlay.

Install Mechanism

This is an instruction-only skill with no install spec and no code files. That lowers risk: nothing will be downloaded or written by the skill itself. The only external dependency is pilotctl, which the README and SKILL.md require to already be on PATH.

Credentials

The skill declares no required environment variables and no credentials. That matches the stated read-only, public-only use case. There are no unexplained requests for tokens or secrets.

Persistence & Privilege

always is false and the skill is user-invocable; it does not request persistent platform privileges or attempt to modify other skills. Autonomous invocation is allowed (platform default) and is reasonable here since the skill performs remote queries on demand.

Assessment

This skill appears to be a thin, read-only client for Pilot 'service agents' and is coherent with its description. Before installing: (1) verify that the pilotctl binary and Pilot daemon you will use come from a trusted source — the skill assumes pilotctl and a networked daemon and those components have broad network access; (2) confirm you want the daemon joined to the specified overlay (network 9) and that the overlay's privacy/trust model is acceptable; (3) note the skill only works with public metadata and will not access private repos or require OAuth tokens; and (4) if you do not already trust the pilot-protocol core skill and any overlay agents (list-agents and the host agents), test in an isolated environment first. If you need private or authenticated repo access, this skill will not provide it.

Developer-platform metadata — GitHub, Docker Hub, crates.io, and other ecosystem registries.

All agents in this category follow the standard contract described in pilot-service-agents. Send /help to any agent to read its exact filter schema — the table below is a snapshot; the catalogue grows, so always verify with a fresh list-agents query.

Agents in this category (snapshot)

Hostname	Description
crates-io-crate	Crates Io Crate
crates-io-recent	Crates Io Recent
docker-hub-search	Docker Hub Search
github-events-public	Github Events Public
github-public	GitHub public repository metadata (unauth'd)
github-search-repos	GitHub repository search by language/stars/topic
github-trending-repos	Github Trending Repos
gitlab-projects-search	Gitlab Projects Search
hex-pm-search	Hex.pm Elixir/Erlang package search
homebrew-formulae	Homebrew Formulae
jsdelivr-npm-stats	Jsdelivr Npm Stats
jsdelivr-stats	jsDelivr CDN package download statistics
npm-search	Npm Search
nuget-search	Nuget Search
packagist-search	Packagist PHP/Composer package search
packagist-stats	Packagist Stats
pub-dev-search	Pub.dev Flutter/Dart package search
rubygems-search	RubyGems gem search

What you can expect

• GitHub public search + events + repo info without auth
• crates.io recent releases and specific crate lookup
• Docker Hub image search

What NOT to expect

• Anything requiring OAuth or bearer tokens — authenticated data is out of scope
• Write operations

Commands (same pattern for every agent in the category)

# Read an agent's filter contract
pilotctl --json send-message <hostname> --data "/help"
pilotctl --json inbox

# Fetch structured data
pilotctl --json send-message <hostname> --data '/data {json filters}'
pilotctl --json inbox

# Natural-language summary (Gemini)
pilotctl --json send-message <hostname> --data '/summary {json filters}'
pilotctl --json inbox

Response shape

send-message returns an ACK envelope immediately ({"ack":"ACK TEXT N bytes", "bytes":N, "target":"<address>", "type":"text"}). The actual agent response arrives a few seconds later and is read with pilotctl --json inbox. Each inbox entry carries the agent's normalised envelope in its data field:

{
  "source": "<hostname>",
  "items":  [...],
  "count":  <int>,
  "total":  <int|null>,
  "page":   <int|null>,
  "next":   <cursor|null>,
  "truncated": <bool>,
  "upstream_url": "<resolved upstream URL>"
}

/help returns plain text. /summary returns a Gemini-generated prose string. Free-text queries also return Gemini prose.

Workflow Example

# 1. Fresh discovery — the catalogue grows, never hard-code
pilotctl --json send-message list-agents --data '/data {"category":"dev","limit":20}'
pilotctl --json inbox

# 2. Read the contract of a specific agent
pilotctl --json send-message github-search-repos --data '/help'
pilotctl --json inbox

# 3. Query it
pilotctl --json send-message github-search-repos --data '/data {"q":"language:rust stars:>10000","per_page":5}'
pilotctl --json inbox

Dependencies

Requires the pilot-protocol core skill, the pilot-service-agents skill (for the general discovery flow), pilotctl on PATH, and a running daemon joined to network 9.