Skill: teoslayer/pilot-service-agents-security (version 1.0.0)

--- name: pilot-service-agents-security description: > Security and threat-intel lookups — CVEs, certificate transparency, URL/IP threat checks, DNS, WHOIS. Use this skill when: 1. Looking up a CVE (NVD, MITRE CVE, Shodan CVEDB) 2. Certificate transparency or domain WHOIS / RDAP lookup 3. URL / IP threat classification (Web Risk premium, Mullvad, ProxyCheck) Do NOT use this skill when: - Active scanning or exploitation — these are read-only lookups - Breach-data *exposure* — HIBP agent returns breach descriptors only tags: - pilot-protocol - service-agents - security - threat-intel license: AGPL-3.0 compatibility: > Requires pilot-protocol skill, pilotctl binary on PATH, a running daemon joined to network 9 (data-exchange), and the `list-agents` directory agent reachable on the overlay. metadata: author: vulture-labs version: "1.0" openclaw: requires: bins: - pilotctl homepage: https://pilotprotocol.network allowed-tools: - Bash --- # pilot-service-agents-security Security and threat-intel lookups — CVEs, certificate transparency, URL/IP threat checks, DNS, WHOIS. All agents in this category follow the standard contract described in `pilot-service-agents`. Send `/help` to any agent to read its exact filter schema — the table below is a snapshot; the catalogue grows, so always verify with a fresh `list-agents` query. ## Agents in this category (snapshot) | Hostname | Description | |---|---| | `crtsh` | Certificate transparency log search | | `cveawg-mitre` | MITRE CVE record | | `cvedb-shodan` | Shodan CVEDB lookup by CVE id | | `dns-google` | Google public DNS resolver (A/AAAA/MX/TXT records) | | `gcp-web-risk` | Google Web Risk URL threat detection | | `haveibeenpwned-domains` | HIBP latest data-breach record | | `mullvad-connection` | Connection info: IP, country, ISP, VPN detection | | `nvd-cves` | NVD CVE search | | `proxycheck` | Proxy/VPN/abuse IP lookup | | `rdap-domain` | RDAP domain WHOIS lookup (IETF standard) | | `rdap-ip` | RDAP IP address registration lookup | | `shodan-internetdb` | Shodan IP port/vuln/hostname reconnaissance | ## What you can expect - Multiple CVE feeds for cross-checking - crt.sh for subdomain discovery via issued certs - DNS resolution via Google and RDAP WHOIS ## What NOT to expect - Zero-day early disclosures - Paid commercial threat-intel feeds — only public data ## Commands (same pattern for every agent in the category) ```bash # Read an agent's filter contract pilotctl --json send-message <hostname> --data "/help" pilotctl --json inbox # Fetch structured data pilotctl --json send-message <hostname> --data '/data {json filters}' pilotctl --json inbox # Natural-language summary (Gemini) pilotctl --json send-message <hostname> --data '/summary {json filters}' pilotctl --json inbox ``` ## Response shape `send-message` returns an ACK envelope immediately (`{"ack":"ACK TEXT N bytes", "bytes":N, "target":"<address>", "type":"text"}`). The **actual agent response** arrives a few seconds later and is read with `pilotctl --json inbox`. Each inbox entry carries the agent's normalised envelope in its `data` field: ```json { "source": "<hostname>", "items": [...], "count": <int>, "total": <int|null>, "page": <int|null>, "next": <cursor|null>, "truncated": <bool>, "upstream_url": "<resolved upstream URL>" } ``` `/help` returns plain text. `/summary` returns a Gemini-generated prose string. Free-text queries also return Gemini prose. ## Workflow Example ```bash # 1. Fresh discovery — the catalogue grows, never hard-code pilotctl --json send-message list-agents --data '/data {"category":"security","limit":20}' pilotctl --json inbox # 2. Read the contract of a specific agent pilotctl --json send-message nvd-cves --data '/help' pilotctl --json inbox # 3. Query it pilotctl --json send-message nvd-cves --data '/data {"cveId":"CVE-2021-44228"}' pilotctl --json inbox ``` ## Dependencies Requires the `pilot-protocol` core skill, the `pilot-service-agents` skill (for the general discovery flow), `pilotctl` on PATH, and a running daemon joined to network 9.

path: README.md
content: # Service Agents — Security

Security and threat-intel lookups — CVEs, certificate transparency, URL/IP threat checks, DNS, WHOIS.

**Category:** Data Sources | **License:** AGPL-3.0

## Install

```bash
clawhub install pilot-service-agents-security
```

## Requirements

- [Pilot Protocol](https://pilotprotocol.network) daemon running (`pilotctl daemon start`)
- `pilotctl` binary on PATH
- Daemon joined to network 9 (`pilotctl --json network join 9`)
- `list-agents` directory agent reachable on the overlay

## Tags

`pilot-protocol`, `service-agents`, `security`, `threat-intel`

## Documentation

See [SKILL.md](SKILL.md) for the full skill definition including commands, examples, and error handling.

## Links

- [ClawHub](https://clawhub.ai/teoslayer/pilot-service-agents-security)
- [Pilot Protocol](https://pilotprotocol.network)
- [All Skills](https://teoslayer.github.io/pilot-skills/)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)