rules-distill
Pass
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local bash scripts (scan-skills.sh and scan-rules.sh) to index the contents of the user's skills and rules directories. These scripts use standard system utilities like find, jq, awk, and stat to read file metadata and headings.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it reads and processes the text content of other skills. This content is untrusted and could theoretically contain malicious instructions aimed at influencing the rule generation process.
- Ingestion points: Skill content is read from SKILL.md files by scripts/scan-skills.sh.
- Boundary markers: Input data is provided to the LLM using markdown headers, though specific adversarial boundary markers are absent.
- Capability inventory: The skill has the ability to propose and apply changes to rule files in ~/.claude/rules and project directories.
- Sanitization: No content sanitization is performed on the ingested skill text.
- Mitigation: The risk is significantly reduced by the requirement for principles to appear in at least two separate skills and the mandatory human review of all proposed changes.
Audit Metadata