Pilot Model Share

Distribute ML model files with model card metadata and version tracking over Pilot Protocol. Use this skill when: 1. You need to share PyTorch, ONNX, or Safe...

This skill appears to do what it says, but check a few practical things before installing: 1) Ensure the pilotctl daemon and peers are trusted (pilotctl likely has its own keys/config — verify where they are stored and who can access them). 2) The SKILL.md uses jq and md5sum but the registry only declared pilotctl; confirm jq and a hashing tool are available on the agent. 3) Replace MD5 with a stronger hash (SHA-256 or an authenticated signature) if you need robust integrity guarantees, since MD5 is weak against collisions. 4) Be aware you are transmitting model files (which may contain proprietary or sensitive info); only share with authorized peers. 5) If you need to audit or restrict network/file access, test the workflow in a sandbox first. 6) If you will rely on this skill long-term, ask the publisher to update metadata to list jq and the hashing tool and to clarify any pilotctl authentication requirements.

Type: OpenClaw Skill Name: pilot-model-share Version: 1.0.0 The skill provides a legitimate-looking interface for sharing ML models using the 'pilotctl' utility. However, it is classified as suspicious due to a shell injection vulnerability in the bash workflow example within SKILL.md, where the '$model_name' variable is unsafely interpolated into a JSON string passed to a shell command. While no clear evidence of intentional malice or data exfiltration was found, this flaw could be exploited if an attacker controls the model name.