pilot-protocol

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The skill instructs fetching and running a direct install.sh from pilotprotocol.network — a non-vendor domain delivering a shell installer is a high-risk vector for malware distribution.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill enables installing a persistent P2P daemon that auto-accepts public service messages and installs remote app-store packages, creating clear vectors for remote code execution, supply-chain compromise, and data exfiltration if abused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The “pilot-protocol” workflow can ingest outsider-authored free text because it reads JSON replies written to ~/.pilot/inbox/*.json from pilotctl send-message list-agents ... --wait, where the returned agent/service payload may contain attacker-controlled text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs downloading and then executing an installer fetched at runtime from https://pilotprotocol.network/install.sh (curl ... -o "$installer" then sh "$installer"), which fetches remote code and runs it.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs downloading and executing an installer (sh "$installer"), starting a persistent daemon that joins a public P2P network, and installing local app-store packages — all state-changing actions that modify the host environment and can alter system state.