distill-skill-to-model
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process entire 'Agent Skill' packages, including their instructions, scripts, and tool definitions. This creates an attack surface where a malicious source skill could attempt to influence the distillation process.
- Ingestion points: The pipeline resolves and hashes
SKILL.md, referenced instructions, scripts, and assets from external source directories. - Boundary markers: The plan specifies removing the 'teacher-only'
SKILL.mdpayload from training records and utilizes a pinned runtime manifest with a sandbox image to isolate execution. - Capability inventory: The skill involves executing the full workflow and tools of the source skill package to generate training trajectories.
- Sanitization: The methodology includes layered verification of tool-call syntax, semantic and final-state correctness checks, human auditing of samples, and deduplication of training data.- [EXTERNAL_DOWNLOADS]: The skill references external model weights and software libraries from well-known repositories.
- Evidence: Mentions downloading the
Qwen/Qwen3-4B-Instruct-2507model from Hugging Face and theMLX-LMframework from Apple's GitHub repository.
Audit Metadata