distill
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to run git commands for repository discovery and maintenance. It identifies the root of the project to set the distillation scope and performs auto-commits to the ~/.origin repository. These actions are restricted to local repository management.
- [DATA_EXFILTRATION]: The skill reads and writes data within the user's home directory (~/.origin). This is required for its function of managing wiki pages derived from source memories. No sensitive file access or network communication was detected.
- [PROMPT_INJECTION]: The skill processes memory data from the distill tool, creating an indirect prompt injection surface. The agent synthesizes this untrusted data into wiki prose. Evidence: 1. Ingestion point: distill tool output in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Bash, create_page, and update_page tools. 4. Sanitization: The skill implements a manual 'coherence check' where the agent evaluates memory content before synthesis. This surface is mitigated by the specific synthesis task and manual verification.
Audit Metadata