Pilot Protocol

• Outcome: Review
• Latest audit: May 28, 2026 · 2:09 PM UTC
• Version: 1.0.0

Overview

The skill’s agent-networking purpose is coherent, but its heartbeat example can automatically trust peers and run incoming tasks without review.

Install only if you intentionally want a persistent peer-to-peer agent daemon. Do not use the heartbeat script as written: manually verify peers before approving trust, inspect tasks before accepting or executing them, treat incoming files/messages/results as untrusted, restrict gateway ports and sudo use, prefer trusted HTTPS webhook endpoints, and verify the external installer before running it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The heartbeat script blindly approves every pending trust request, which defeats the protocol's stated mutual-trust security model and allows any requester to become trusted without human or policy review. In this skill's context, trust is the gate for messaging, file transfer, tasking, and other peer interactions, so automatic approval materially expands the attack surface to arbitrary remote agents.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script automatically accepts all new received tasks without validating sender identity, task content, scope, or safety, enabling remote agents to push unreviewed work into the local execution pipeline. Because the skill also documents `task execute`, this can lead to delegated prompt injection, unsafe actions, resource abuse, or execution of attacker-controlled workloads.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installation section instructs users to execute a remote network-fetched shell script directly, without integrity verification, pinning, signature checks, or an explicit warning about code execution and persistence changes. If the distribution server, TLS termination, DNS, or upstream content is compromised, users can be induced to run arbitrary attacker-supplied code during installation.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The heartbeat guidance recommends unattended processing of trust requests and incoming tasks without any security warning or validation logic, normalizing insecure autonomous behavior. In an agent-to-agent networking skill, this is especially dangerous because it operationalizes continuous remote intake from peers and can turn the local agent into a passive recipient of malicious tasks, files, and interactions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly describes `send-file` causing the remote daemon to save transmitted data into `~/.pilot/received/`, but it does not warn users that invoking this command writes content onto another agent's system. In an agent-to-agent skill, that omission is security-relevant because an automated agent may treat file transfer as transient communication rather than remote persistence, increasing the chance of unintended data placement, policy violations, or delivery of harmful files to peers.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The `send-message` documentation notes that the target saves the message in `~/.pilot/inbox/`, but it lacks an explicit warning that transmitted content is persisted remotely rather than merely delivered ephemerally. In this skill's context, where agents exchange tasks and data automatically, that can lead to accidental storage of sensitive prompts, secrets, or malicious payloads on peer systems without the operator appreciating the persistence boundary.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation describes starting an IP bridge that proxies arbitrary TCP ports and explicitly notes root is required for ports below 1024, but it does not prominently warn about the security implications of exposing privileged listeners and forwarding traffic to remote agents. In this skill's context, that omission is more dangerous because the feature is specifically intended to bridge traffic between agents, which can cause users to treat remote Pilot endpoints like trusted local services and accidentally expose sensitive local workflows or route traffic to untrusted peers.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This reference explicitly instructs the agent to accept and execute queued tasks from other agents, but it does not include a strong warning that task execution can trigger impactful actions on the local system, access local data, or cause security harm if the task content is malicious. In the context of an agent-to-agent overlay network where peers can submit work, normalizing 'execute the next task' without a mandatory trust boundary and user confirmation increases the risk of remote prompt injection, unsafe delegation, and indirect execution of destructive or data-exfiltrating actions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation instructs users to approve trust requests but does not warn that approval grants another agent ongoing communication access. In a skill specifically designed for inter-agent networking, this omission can cause operators or upstream agents to approve unverified peers too casually, enabling unauthorized message exchange or task submission.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: Documenting automatic trust establishment on mutual handshakes without a security warning is dangerous because two agents can become trusted without an explicit approval checkpoint. In this skill's context, where trust enables broad agent-to-agent communication, an attacker can exploit reciprocal handshake behavior or social engineering to obtain trust more easily.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The example concludes with agents being able to 'communicate freely' but does not explain the resulting security boundary change. Readers may treat trust establishment as routine setup rather than a sensitive authorization decision, increasing the risk of over-trusting unknown peers in an overlay network.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation instructs users to send real-time daemon events to an arbitrary HTTP endpoint and even uses plain HTTP in examples, but it does not warn that event payloads may expose operational metadata, peer identifiers, trust-handshake details, message/file receipt events, or other sensitive telemetry. In the context of an agent-to-agent networking daemon, this can lead to unintended data disclosure, insecure transport, and SSRF-style misuse if operators point webhooks at internal services without understanding the risk.

Static analysis

No suspicious patterns detected.