Pilot Service Agents Geo

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:43 PM UTC
• Version:
  1.0.0

Overview

This is a documentation-only geo lookup skill that delegates user-requested queries to Pilot Protocol agents, with privacy and routing caveats but no hidden code or automatic behavior.

Install only if you trust Pilot Protocol, the network 9 overlay, and the remote agents/providers that will receive your geo queries. Avoid submitting sensitive IPs, WiFi or cell identifiers, precise coordinates, or personal addresses without consent, and route flight-tracking requests to the dedicated flights skill rather than using opensky-bbox from this geo skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill metadata explicitly says it should not be used for flight tracking, yet the catalogue includes `opensky-bbox`, a live aircraft-state lookup capability. This creates a scope-boundary contradiction that can misroute users or downstream agents into using the wrong skill for aviation data, weakening policy controls and increasing the chance of unintended sensitive surveillance use.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Advertising live aircraft-state retrieval inside a geolocation skill expands capability beyond the stated maps/geocoding purpose and can enable covert tracking or policy bypass. In this context, the mismatch is dangerous because users may invoke flight-surveillance functionality without the safeguards, review, or narrower handling expected from a dedicated aviation skill.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill promotes IP geolocation and Google geolocation from WiFi/cell/IP but provides no privacy warning that potentially sensitive network identifiers and location data will be sent to third-party services. This omission can lead operators to transmit personal or device-derived data externally without informed consent, minimization, or compliance checks.

VirusTotal

63/63 vendors flagged this skill as clean.