Pilot Dataset

Exchange structured datasets with schema negotiation and metadata over Pilot Protocol. Use this skill when: 1. You need to share CSV, JSON, or Parquet datase...

This skill appears to do what it claims (share structured datasets via the Pilot Protocol). Before installing: 1) verify the pilotctl binary you have is the official release for Pilot Protocol and that you trust it, 2) be aware that using the skill will read and transmit local files ($DATASET_FILE) to remote peers ($PEER / $DEST) — do not send sensitive data inadvertently, 3) ensure jq/python3 are available if you rely on format conversion, and 4) run the pilot daemon in a controlled environment and review pilotctl logs to confirm expected transfers. If you need to ensure no secrets are leaked, explicitly set and inspect the environment variables and test with non-sensitive sample datasets first.

Type: OpenClaw Skill Name: pilot-dataset Version: 1.0.0 The skill contains multiple shell injection vulnerabilities in the Bash examples provided in SKILL.md. Specifically, the use of unquoted variables such as `$file`, `$name`, and `$PEER` within command substitutions (e.g., `wc -l < "$file"`) and JSON data strings allows for arbitrary command execution if the AI agent populates these fields with unsanitized input. While the functionality aligns with the stated purpose of dataset exchange via the 'pilotctl' utility, the lack of input validation in the documented workflow poses a significant security risk.