rules-distill
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes bundled bash scripts (
scripts/scan-skills.shandscripts/scan-rules.sh) to perform an inventory of local skill directories and rule files. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from other installed skills and rule files, which creates a surface for indirect prompt injection if those files contain malicious instructions meant to subvert the distillation logic.
- Ingestion points: Reads the full text of all
SKILL.mdfiles and rule files found in the configured paths. - Boundary markers: The analysis prompt uses template markers (
{full text of skills in this batch}) to separate context, though it lacks specialized delimiters to prevent the LLM from following instructions embedded within the ingested data. - Capability inventory: Executes local inventory scripts and has the capability to modify Markdown rule files.
- Sanitization: The skill mitigates risks through a mandatory human-in-the-loop review process, explicitly requiring user approval for each proposed change before execution.
Audit Metadata