distill
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze existing source code provided by the user to extract behavior specifications. Although it is a standard development task, the ingestion of untrusted code creates a surface for indirect prompt injection.
- Ingestion points: The skill reads source code from a user-specified module, directory, or functionality as defined in Step 3 of the process flow in
SKILL.md. - Boundary markers: The instructions do not specify the use of clear delimiters or "ignore embedded instructions" prompts when the agent reads the source code. This lack of boundaries increases the risk that malicious instructions embedded in the code (e.g., in comments or string literals) could influence the agent's behavior during the distillation process.
- Capability inventory: The skill has the capability to write files to the filesystem (
beat/changes/,beat/CONTEXT.md,docs/adr/) and execute Git commands (git add,git commit). - Sanitization: There is no mention of explicit sanitization, filtering, or validation of the ingested code before it is processed to generate Gherkin feature files or other documentation artifacts.
Audit Metadata