Pilot Audit Log

该 Skill 通过 Bash 脚本和 pilotctl 将握手、信任审批等事件写入本地 JSONL 审计日志，支持用 grep/jq 查询并按日生成 JSON 报告；使用前需安装 pilot-protocol、pilotctl 与 jq，并运行守护进程。

teoslayer

热度 35.91

最近更新 2026-05-11 17:41:28

分类：安全依赖：代码执行 / 读写文件应用场景：自动化脚本 / 报告撰写 / 工作流 / 数据处理

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add pilot-audit-log

Metadata

name: pilot-audit-log
description: Comprehensive audit trail of all Pilot Protocol activity for security and compliance. Use this skill when: 1. You need detailed logs of all trust decisions and connections 2. You require compliance audit trails for security reviews 3. You want to investigate suspicious activity or incidents Do NOT use this skill when: - You need real-time alerting (use pilot-watchdog instead) - You only need basic daemon logs (use pilotctl info) - You're doing performance profiling (use dedicated profiling tools)
tags: ["pilot-protocol","trust-security","audit","compliance"]
license: AGPL-3.0
compatibility: Requires pilot-protocol skill and pilotctl binary on PATH. The daemon must be running (pilotctl daemon start).
metadata: {"author":"vulture-labs","version":"1.0","openclaw":{"requires":{"bins":["pilotctl"]},"homepage":"https://pilotprotocol.network"}}
allowed-tools: ["Bash"]

Pilot Audit Log

Comprehensive audit logging for Pilot Protocol with structured event capture, retention policies, and compliance-ready output formats.

Commands

Initialize audit log:

mkdir -p ~/.pilot/audit
cat > ~/.pilot/audit/config.json <<EOF
{
  "enabled": true,
  "log_file": "$HOME/.pilot/audit/events.jsonl",
  "retention_days": 90,
  "event_types": ["trust.handshake", "trust.approve", "connection.open"]
}
EOF

Log trust events:

log_audit() {
  local EVENT_TYPE=$1
  local DETAILS=$2
  echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) $EVENT_TYPE $DETAILS" >> ~/.pilot/audit/events.jsonl
}

pilotctl --json handshake "$AGENT" "Audit test"
log_audit "trust.handshake" "{\"agent\": \"$AGENT\"}"

Query audit log:

grep "trust.approve" ~/.pilot/audit/events.jsonl
jq 'select(.event_type == "trust.approve")' ~/.pilot/audit/events.jsonl

Generate audit report:

cat > ~/.pilot/audit/report-$(date +%Y-%m-%d).json <<EOF
{
  "date": "$(date +%Y-%m-%d)",
  "total_events": $(wc -l < ~/.pilot/audit/events.jsonl),
  "handshakes": $(grep -c "trust.handshake" ~/.pilot/audit/events.jsonl || echo 0),
  "approvals": $(grep -c "trust.approve" ~/.pilot/audit/events.jsonl || echo 0)
}
EOF

Workflow Example

#!/bin/bash
# Audit logging with automatic event capture

AUDIT_DIR=~/.pilot/audit
LOG_FILE=$AUDIT_DIR/events.jsonl
mkdir -p "$AUDIT_DIR"

audit_log() {
  local EVENT_TYPE=$1
  local AGENT=$2
  local ACTION=$3
  local RESULT=$4

  cat >> "$LOG_FILE" <<EOF
{"timestamp":"$(date -u +%Y-%m-%dT%H:%M:%SZ)","event_type":"$EVENT_TYPE","agent":"$AGENT","action":"$ACTION","result":"$RESULT"}
EOF
}

# Wrap trust commands with audit logging
audit_handshake() {
  local AGENT=$1
  audit_log "trust" "$AGENT" "handshake" "started"

  if pilotctl --json handshake "$AGENT" "Audit tracked"; then
    audit_log "trust" "$AGENT" "handshake" "success"
  else
    audit_log "trust" "$AGENT" "handshake" "failed"
  fi
}

audit_handshake "agent1.pilot"

Dependencies

Requires pilot-protocol skill, pilotctl binary, running daemon, and jq for JSON parsing.