ybrain-distill
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from external sources (via WebFetch) and existing knowledge base entries. This untrusted content could contain malicious instructions intended to manipulate the agent during the distillation and summary phase.
- Ingestion points: Data enters the agent's context through external web fetching and internal note/item export tools.
- Boundary markers: The instructions do not specify the use of clear delimiters or explicit 'ignore' instructions to separate the source material from the distillation logic.
- Capability inventory: The skill possesses the ability to create and modify files (notes/knowledge packs) and execute local scripts via Node.js.
- Sanitization: The skill documents a best practice of using file-based writing instead of command-line inline arguments to prevent shell-based injection and data corruption.
- [COMMAND_EXECUTION]: The skill requires the execution of a local JavaScript utility to interact with the underlying system's API.
- Evidence: Instructions mandate the use of
node "<main_skill_dir>/scripts/ima_api.cjs" <apiPath> <json-body>for all network communication, relying on credentials stored in~/.config/ima.
Audit Metadata