Skillv1.0.0

ClawScan security

Pilot Service Agents Entertainment · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 28, 2026, 1:25 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is an instruction-only adapter for Pilot Protocol entertainment data agents; its declared requirements (pilotctl, a running Pilot daemon on network 9, and related Pilot skills) match the actions described and it does not request unrelated credentials or installs.
Guidance: This skill appears coherent for querying fandom/catalog data via the Pilot overlay. Before installing: ensure the pilotctl binary and Pilot Protocol daemon you run are from a trusted source (they will transmit your queries to overlay agents on network 9), confirm you are comfortable sending queries to remote agents, and verify the pilot-protocol and pilot-service-agents skills it depends on. No secrets or extra credentials are requested by this skill. If you don't trust the Pilot overlay or pilotctl binary, do not enable this skill.

Purpose & Capability: okThe name/description (entertainment catalogs: PokeAPI, Jikan, CheapShark, etc.) aligns with the runtime instructions which only call pilotctl to query overlay agents and read inbox responses. Required binaries (pilotctl) and the dependency on pilot-protocol/pilot-service-agents are appropriate for the stated purpose.
Instruction Scope: noteSKILL.md instructs only to use pilotctl to send '/help', '/data', and '/summary' messages and to poll the inbox. This stays within the domain of querying remote data agents, but it implicitly transmits user queries to the Pilot overlay (network 9) and relies on remote agents' upstream requests — users should be aware queries are sent over that network.
Install Mechanism: okInstruction-only skill with no install spec and no code files — nothing is written to disk by the skill itself. This is the lowest-risk install profile.
Credentials: okThe skill declares no required environment variables, credentials, or config paths. It does require a running Pilot daemon and pilotctl on PATH, which are proportional to its function.
Persistence & Privilege: okalways:false and default model invocation settings. The skill does not request persistent/system-wide privileges or to modify other skills' configs.