rules-distill
Warn
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
bashto execute local scripts (scan-skills.shandscan-rules.sh) located in the skill's own directory (~/.claude/skills/rules-distill/scripts/). These scripts utilizefind,grep,awk, andjqto traverse the user's home directory to locate.claude/skillsand.claude/rulesdirectories. - [EXTERNAL_DOWNLOADS]: While no hardcoded external URLs are present, the skill's architecture involves feeding the full text of local skill and rule files into a sub-agent (LLM). This pattern creates a surface for Indirect Prompt Injection if the skills being scanned contain malicious instructions designed to influence the distillation process.
- [COMMAND_EXECUTION]: The shell scripts use environment variables (
RULES_DISTILL_DIR,RULES_DISTILL_GLOBAL_DIR,RULES_DISTILL_PROJECT_DIR) to determine scan paths. While intended for testing, this pattern allows for dynamic path configuration that could be misused to scan unintended directories if the environment is compromised.
Audit Metadata