Skill Distiller (Compressed)

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:39 PM UTC
• Version:
  0.2.1

Overview

This is an instruction-only skill for compressing skill files, with modest disclosed local persistence and no evidence of hidden or harmful behavior.

Before installing, expect this skill to process skill markdown and potentially create or append local calibration/output files in the workspace. Use dry-run or review the output first if you do not want workspace changes, and avoid configuring external model providers or API keys unless you trust the environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill instructs the agent to append calibration data to `.learnings/skill-distiller/calibration.jsonl`, which is a workspace write operation. Because the skill is user-invocable and the document does not clearly warn that running it will modify local files or require explicit user consent before writing, it can cause unexpected changes to the user's repository or workspace state.

VirusTotal

66/66 vendors flagged this skill as clean.