distill-to-skill
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from external sources (articles, repos, URLs) and process it into new instructions.
- Ingestion points: SKILL.md, Step 1 explicitly instructs the agent to "Fetch the URL and read the full content" and "explore directory structure" of repositories.
- Boundary markers: The instructions lack guidance for the agent to use delimiters or "ignore embedded instructions" warnings when processing these external sources.
- Capability inventory: While the skill itself is composed of markdown instructions and does not include executable scripts, it is designed for agents with tools to fetch web content and read repository files.
- Sanitization: No sanitization or validation of the ingested external content is required or described in the workflow.
Audit Metadata