Pilot Sync

Bidirectional file synchronization between agents over the Pilot Protocol network. Use this skill when: 1. You need to keep directories synchronized between...

This skill appears to do what it says (send files via pilotctl), but there are a few issues to check before using it: - The SKILL.md expects jq, fswatch or inotifywait, md5sum, and stat, but only pilotctl is declared as required; ensure those binaries are present and trusted. - The manifest and example loops will transmit filenames, checksums, and mtimes (and the file contents) to remote Pilot peers—confirm you trust the remote node(s) and understand what will be shared. - The stat command shown (stat -f %m) is BSD/macOS-specific; on Linux you may need a different stat invocation. The example shell code also may break on filenames with newlines or special characters. - pilotctl uses local credentials/config (not listed); verify what keys/config pilotctl will use and whether you consent to those credentials being able to send files. - Consider adding filtering, error handling, and authentication/authorization checks (verify remote ID) before running the examples. If the publisher updates the metadata to list all required binaries and documents pilotctl auth/config requirements, and the examples are made more robust/portable, the skill would be more trustworthy.

Type: OpenClaw Skill Name: pilot-sync Version: 1.0.0 The skill provides bidirectional file synchronization using the pilotctl utility and the Pilot Protocol. It is classified as suspicious because the workflow example in SKILL.md contains a shell injection vulnerability: the find command interpolates filenames directly into a shell string (sh -c), which could allow arbitrary command execution if the directory being synchronized contains files with specially crafted names. While the functionality aligns with the stated purpose, this implementation flaw poses a significant security risk.