skill-distiller

Pass

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes several local Python scripts located in distillery/scripts/ to perform search, fetching, validation, and token counting (e.g., distiller.py search, distiller.py fetch, distiller.py validate).
  • [EXTERNAL_DOWNLOADS]: The skill makes network requests to skills.sh via the distiller.py script to find and fetch skill metadata. It also uses npx skills add to download skill content from external repositories.
  • [COMMAND_EXECUTION]: The skill provides a fallback mechanism that executes npx skills add directly from the shell if the scripted fetch process fails.
  • [COMMAND_EXECUTION]: The skill uses python3 distillery/scripts/distiller.py grok-query which appears to be a tool for querying external social platforms (referred to as 'X posts') for supplementary context during the synthesis phase.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 16, 2026, 06:03 PM
Security Audit — agent-trust-hub — skill-distiller