pilot-service-agents-security#

Security and threat-intel lookups — CVEs, certificate transparency, URL/IP threat checks, DNS, WHOIS.

All agents in this category follow the standard contract described in pilot-service-agents. Send /help to any agent to read its exact filter schema — the table below is a snapshot; the catalogue grows, so always verify with a fresh list-agents query.

Agents in this category (snapshot)#

HostnameDescriptioncrtshCertificate transparency log searchcveawg-mitreMITRE CVE recordcvedb-shodanShodan CVEDB lookup by CVE iddns-googleGoogle public DNS resolver (A/AAAA/MX/TXT records)gcp-web-riskGoogle Web Risk URL threat detectionhaveibeenpwned-domainsHIBP latest data-breach recordmullvad-connectionConnection info: IP, country, ISP, VPN detectionnvd-cvesNVD CVE searchproxycheckProxy/VPN/abuse IP lookuprdap-domainRDAP domain WHOIS lookup (IETF standard)rdap-ipRDAP IP address registration lookupshodan-internetdbShodan IP port/vuln/hostname reconnaissance

What you can expect#

• Multiple CVE feeds for cross-checking
• crt.sh for subdomain discovery via issued certs
• DNS resolution via Google and RDAP WHOIS

What NOT to expect#

• Zero-day early disclosures
• Paid commercial threat-intel feeds — only public data

Commands (same pattern for every agent in the category)#

bash

# Read an agent's filter contract
pilotctl --json send-message <hostname> --data "/help"
pilotctl --json inbox

# Fetch structured data
pilotctl --json send-message <hostname> --data '/data {json filters}'
pilotctl --json inbox

# Natural-language summary (Gemini)
pilotctl --json send-message <hostname> --data '/summary {json filters}'
pilotctl --json inbox

Response shape#

send-message returns an ACK envelope immediately ( {"ack":"ACK TEXT N bytes", "bytes":N, "target":"<address>", "type":"text"}). The actual agent response arrives a few seconds later and is read with pilotctl --json inbox. Each inbox entry carries the agent's normalised envelope in its data field:

json

{
  "source": "<hostname>",
  "items":  [...],
  "count":  <int>,
  "total":  <int|null>,
  "page":   <int|null>,
  "next":   <cursor|null>,
  "truncated": <bool>,
  "upstream_url": "<resolved upstream URL>"
}

/help returns plain text. /summary returns a Gemini-generated prose string. Free-text queries also return Gemini prose.

Workflow Example#

bash

# 1. Fresh discovery — the catalogue grows, never hard-code
pilotctl --json send-message list-agents --data '/data {"category":"security","limit":20}'
pilotctl --json inbox

# 2. Read the contract of a specific agent
pilotctl --json send-message nvd-cves --data '/help'
pilotctl --json inbox

# 3. Query it
pilotctl --json send-message nvd-cves --data '/data {"cveId":"CVE-2021-44228"}'
pilotctl --json inbox

Dependencies#

Requires the pilot-protocol core skill, the pilot-service-agents skill (for the general discovery flow), pilotctl on PATH, and a running daemon joined to network 9.