Pilot Quarantine

面向 Pilot Protocol 网络的临时隔离技能：用 pilotctl 取消目标节点信任并断开其连接，把隔离原因等写入本地隔离记录文件，支持列出与解除隔离，并可脚本化批量强制执行隔离。需 pilotctl 守护进程与 pilot-protocol 技能配合。

teoslayer

热度 35.61

最近更新 2026-05-18 11:40:13

分类：安全依赖：代码执行 / 读写文件应用场景：自动化脚本 / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add pilot-quarantine

Metadata

name: pilot-quarantine
description: Isolate suspicious agents pending investigation in Pilot Protocol networks. Use this skill when: 1. You detect compromised or suspicious agents that need isolation 2. You want to temporarily suspend trust without permanent blocking 3. You need to investigate agent behavior before making final trust decisions Do NOT use this skill when: - You need permanent blocking (use pilot-blocklist) - You're doing preventive blocking (use trust policies) - You need immediate disconnect (use pilotctl disconnect)
tags: ["pilot-protocol","trust-security","incident-response"]
license: AGPL-3.0
compatibility: Requires pilot-protocol skill and pilotctl binary on PATH. The daemon must be running (pilotctl daemon start).
metadata: {"author":"vulture-labs","version":"1.0","openclaw":{"requires":{"bins":["pilotctl"]},"homepage":"https://pilotprotocol.network"}}
allowed-tools: ["Bash"]

Pilot Quarantine

Temporary isolation system for suspicious agents with investigation workflows and automated review.

Commands

Quarantine Agent

AGENT="suspicious.pilot"
QUARANTINE_ID=$(openssl rand -hex 6)
NODE_ID=$(pilotctl --json find "$AGENT" | jq -r '.node_id')

pilotctl --json untrust "$NODE_ID"
pilotctl --json connections | jq -r '.connections[] | select(.remote_hostname == "'"$AGENT"'") | .id' | \
  xargs -I {} pilotctl --json disconnect {}

List Quarantined Agents

for QFILE in ~/.pilot/quarantine/active/*.json; do
  jq -r '"ID: \(.quarantine_id) Agent: \(.agent) Reason: \(.reason)"' "$QFILE"
done

Release from Quarantine

QUARANTINE_ID="abc123"
QFILE=~/.pilot/quarantine/active/$QUARANTINE_ID.json
AGENT=$(jq -r '.agent' "$QFILE")

mv "$QFILE" ~/.pilot/quarantine/resolved/
pilotctl --json handshake "$AGENT" "Quarantine released"

Enforce Quarantine

for QFILE in ~/.pilot/quarantine/active/*.json; do
  AGENT=$(jq -r '.agent' "$QFILE")
  NODE_ID=$(jq -r '.node_id' "$QFILE")

  pilotctl --json connections | jq -r '.connections[] | select(.remote_hostname == "'"$AGENT"'") | .id' | \
    xargs -I {} pilotctl --json disconnect {}
done

Workflow Example

#!/bin/bash
# Quarantine management

mkdir -p ~/.pilot/quarantine/{active,resolved}

AGENT="malicious.pilot"
QUARANTINE_ID=$(openssl rand -hex 6)
NODE_ID=$(pilotctl --json find "$AGENT" | jq -r '.node_id')

pilotctl --json untrust "$NODE_ID"

cat > ~/.pilot/quarantine/active/$QUARANTINE_ID.json <<EOF
{
  "quarantine_id": "$QUARANTINE_ID",
  "agent": "$AGENT",
  "reason": "Port scanning detected",
  "quarantined_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "status": "active"
}
EOF

echo "Quarantined: $AGENT (ID: $QUARANTINE_ID)"

Dependencies

Requires pilot-protocol, pilotctl, jq, openssl. Quarantine records stored in ~/.pilot/quarantine/.