book-distill
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local shell utilities like sha256sum, unzip, and find for book processing and identifier generation.
- [PROMPT_INJECTION]: The skill processes untrusted external content (books), creating an indirect prompt injection surface. Evidence chain: 1. Ingestion points: PDF and EPUB source files read via the agent's tools. 2. Boundary markers: Explicit 'Source text safety' instructions to ignore embedded directives and treat text as factual data only. 3. Capability inventory: File system access (read, write, move, delete) and local shell execution. 4. Sanitization: Filename slugification and manual validation of archive contents to prevent directory traversal.
- [SAFE]: The skill follows security best practices by validating all file paths and slugifying user-controlled strings to prevent path traversal attacks during file creation and archive extraction.
Audit Metadata