Skill Distiller

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:32 AM UTC
• Version: 2.0.1

Overview

This skill is not malicious, but it can automatically create or update persistent agent skills and memory notes without a clear pre-write approval step.

Install only if you want an agent to help maintain or create skills. Before enabling automatic mode, require explicit confirmation before any SKILL.md, registry, or memory write, and review generated skill contents for private data and prompt-injection text before using or publishing them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: skill-distiller
description: "Distill successful workflows into reusable skills with quality gates. Use after completing multi-step tasks to evaluate if the workflow should be saved. Triggers: 'distill this', 'save as skill', 'make this reusable', or automatically at end of complex tasks. Evaluates novelty, success, reuse potential AND grounding (≥10 real samples) before generating SKILL.md. Includes IP boundary check (private vs shared classification), trigger keyword discipline, and pre-publish vet for skills going to public registries. Prevents skill bloat through 4-question quality gates and the 'sycoph

Self-Modification

High

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill explicitly instructs the agent to write a new SKILL.md, which is a form of self-modification or capability extension. In agent environments, allowing a skill to create or modify reusable skills can persist unsafe logic, amplify mistakes, or introduce poisoned instructions that affect future behavior.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

3. Upload to target output destination

text

### Step 3: Write SKILL.md

Standard format:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description includes an automatic activation condition ('automatically at end of complex tasks') that is broad and subjective. In an agent skill system, ambiguous auto-triggering can cause the skill to run without explicit user intent, leading to unintended file creation or workflow persistence actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill directs the agent to write outcomes to memory files such as lessons-learned notes, creating session persistence beyond the current task. Persistent memory writes can store incorrect, sensitive, or attacker-influenced content that later affects agent decisions across sessions.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

**All four must be YES to proceed.** This is stricter than v1's 3-question gate (Novel + Successful + Reusable) because we learned the hard way that "looks reusable" without grounding produces hallucinated skills.

1. **Novel?** — Is this a workflow you haven't done before? (If similar skill exists, UPDATE it instead of creating new)
2. **Successful?** — Did the task complete with verified results? (Failed tasks → write to lessons-learned.md, not a skill)
3. **Reusable?** — Will this exact workflow likely be needed again? (One-off → memory note, not skill)
4. **Grounded?** 🆕 — Do you have ≥10 real samples to back up the workflow? (Without grounding = LLM hallucination dressed as a skill — see Anti-Pattern: "Sycophancy of Completeness")

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The Automatic Distillation Mode allows the skill to trigger after task completion and proceed into creating skills or writing memory entries based on broad conditions. Even though it says to announce results, the scope is still insufficiently bounded, which increases the risk of unsolicited persistence and behavior drift over time.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The automatic mode says that if the gate fails, the agent should still write a lesson to memory, which creates unsolicited persistent state after task completion. This is dangerous because even non-reusable or failed workflows may contain sensitive data, bad conclusions, or attacker-shaped content that becomes durable context.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md

1. Task completes → Compound phase triggers
2. Run 4-question gate
3. If all YES → run distillation process
4. If NO → write lesson to memory
5. **Always announce** what was created (never silent)

🆕 **Automatic ≠ silent.** Even auto-distilled skills must surface to the user with a one-line summary, so they can review/edit/reject before the skill is used in earnest.

Static analysis

No suspicious patterns detected.