Pilot Service Agents Security

Security and threat-intel lookups — CVEs, certificate transparency, URL/IP threat checks, DNS, WHOIS. Use this skill when: 1. Looking up a CVE (NVD, MITRE CV...

Security Scan

The skill is an instruction-only adapter that issues read-only threat-intel queries through the pilotctl/pilot-protocol agent network and its requirements and instructions align with its stated purpose.

Purpose & Capability

Name/description (CVE, CT, WHOIS, URL/IP checks) match the declared requirement for pilotctl, pilot-protocol, and a running daemon on the overlay; requesting pilotctl and the pilot-service-agents core is coherent for this function.

Instruction Scope

SKILL.md only instructs using pilotctl to send /help, /data, /summary and to read the inbox; it does not request unrelated files, credentials, or system paths and explicitly states read-only lookups (no active scanning).

Install Mechanism

Instruction-only skill with no install spec and no code files — nothing is written to disk by the skill itself; this is the lowest-risk install profile.

Credentials

No environment variables, credentials, or config paths are requested; the declared binary dependency (pilotctl) is appropriate for the skill's scope.

Persistence & Privilege

always is false and model invocation is allowed (platform default). The skill does not request permanent elevated presence or modify other skills' configs.

Assessment

This skill appears internally consistent, but before installing: (1) verify the origin and integrity of the pilotctl binary and the pilot-protocol/pilot-service-agents skills you will run, (2) be aware queries are submitted to an overlay network and upstream agents may fetch or log queried identifiers/URLs (avoid sending sensitive secrets), (3) use /help and list-agents first to inspect agent contracts, and (4) test with non-sensitive queries to confirm behavior. Autonomous invocation is allowed by default — if you want stricter control, only invoke the skill manually.

Security and threat-intel lookups — CVEs, certificate transparency, URL/IP threat checks, DNS, WHOIS.

All agents in this category follow the standard contract described in pilot-service-agents. Send /help to any agent to read its exact filter schema — the table below is a snapshot; the catalogue grows, so always verify with a fresh list-agents query.

Agents in this category (snapshot)

Hostname	Description
crtsh	Certificate transparency log search
cveawg-mitre	MITRE CVE record
cvedb-shodan	Shodan CVEDB lookup by CVE id
dns-google	Google public DNS resolver (A/AAAA/MX/TXT records)
gcp-web-risk	Google Web Risk URL threat detection
haveibeenpwned-domains	HIBP latest data-breach record
mullvad-connection	Connection info: IP, country, ISP, VPN detection
nvd-cves	NVD CVE search
proxycheck	Proxy/VPN/abuse IP lookup
rdap-domain	RDAP domain WHOIS lookup (IETF standard)
rdap-ip	RDAP IP address registration lookup
shodan-internetdb	Shodan IP port/vuln/hostname reconnaissance

What you can expect

• Multiple CVE feeds for cross-checking
• crt.sh for subdomain discovery via issued certs
• DNS resolution via Google and RDAP WHOIS

What NOT to expect

• Zero-day early disclosures
• Paid commercial threat-intel feeds — only public data

Commands (same pattern for every agent in the category)

# Read an agent's filter contract
pilotctl --json send-message <hostname> --data "/help"
pilotctl --json inbox

# Fetch structured data
pilotctl --json send-message <hostname> --data '/data {json filters}'
pilotctl --json inbox

# Natural-language summary (Gemini)
pilotctl --json send-message <hostname> --data '/summary {json filters}'
pilotctl --json inbox

Response shape

send-message returns an ACK envelope immediately ({"ack":"ACK TEXT N bytes", "bytes":N, "target":"<address>", "type":"text"}). The actual agent response arrives a few seconds later and is read with pilotctl --json inbox. Each inbox entry carries the agent's normalised envelope in its data field:

{
  "source": "<hostname>",
  "items":  [...],
  "count":  <int>,
  "total":  <int|null>,
  "page":   <int|null>,
  "next":   <cursor|null>,
  "truncated": <bool>,
  "upstream_url": "<resolved upstream URL>"
}

/help returns plain text. /summary returns a Gemini-generated prose string. Free-text queries also return Gemini prose.

Workflow Example

# 1. Fresh discovery — the catalogue grows, never hard-code
pilotctl --json send-message list-agents --data '/data {"category":"security","limit":20}'
pilotctl --json inbox

# 2. Read the contract of a specific agent
pilotctl --json send-message nvd-cves --data '/help'
pilotctl --json inbox

# 3. Query it
pilotctl --json send-message nvd-cves --data '/data {"cveId":"CVE-2021-44228"}'
pilotctl --json inbox

Dependencies

Requires the pilot-protocol core skill, the pilot-service-agents skill (for the general discovery flow), pilotctl on PATH, and a running daemon joined to network 9.