Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward guide for publishing capability information to a Pilot Protocol network, with some disclosure-risk caveats users should review.
Before using this skill, review any capability manifest carefully and remove infrastructure details you do not want visible to other Pilot Protocol peers or registries, such as hostnames, node IDs, endpoints, region, GPU inventory, pricing, or SLA commitments. Treat registry targets as external recipients.
The top-level guidance explicitly directs users away from this skill when they need discovery. Later sections contradict that intent by documenting subscribe, peers --search, and a workflow using find registry, all of which are discovery-related operations.
The skill instructs users to publish structured capability manifests to a network without warning that fields like hostname, node ID, endpoints, location, GPU inventory, pricing, and SLA data may be sensitive. This can cause unintentional information disclosure that aids fingerprinting, targeting, or competitive intelligence collection by untrusted parties on the network.
The manifest frames this skill as an announcement/publishing capability and explicitly says not to use it to discover other agents. However, the documented operations include subscribing to announcements and listing peer capabilities, which are discovery-oriented behaviors rather than merely broadcasting one's own capabilities.
The workflow example actively discovers a registry and publishes manifest contents to it without any user-facing warning or confirmation that data is leaving the local environment. In practice, this increases the risk of accidental exfiltration of operational metadata and service details to an external party or broadly visible registry.
No suspicious patterns detected.
