Skill Distiller

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:23 AM UTC
• Version: 0.2.1

Overview

This skill appears to do what it says: compress skill files, with local calibration logging and optional LLM provider use that users should understand first.

Before installing, be aware that compressed output can weaken a skill if safety-relevant examples or edge cases are removed. Review the diff before replacing any installed skill, and check or delete .learnings/skill-distiller/calibration.jsonl if you do not want local compression history retained.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a skill whose purpose is to compress skill content while preserving important information. The supplied code instead is an integration testing shell script for a skill-distiller project. Its main behavior is to inspect repository files, grep for expected patterns, count lines, and call Ollama to classify a section from a skill file. These are materially different from compression behavior. Although this may support development of a compression-related skill, the chunk itself does not implement the described end-user functionality and introduces undeclared capabilities such as external model invocation and repository-wide test/fixture validation.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

tion (~400 tokens, ~90% functionality, LLM-estimated). Full reference version: `SKILL.reference.md`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

tion (~400 tokens, ~90% functionality, LLM-estimated). Full reference version: `SKILL.reference.md`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md

tion (~400 tokens, ~90% functionality, LLM-estimated). Full reference version: `SKILL.reference.md`.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README promotes compressing skills by removing 'low-importance sections' such as examples and explanations while preserving core triggers and instructions. In practice, examples, explanatory notes, and warning text often carry safety boundaries, misuse constraints, and edge-case handling; a compression tool that deprioritizes them can strip critical safeguards and produce a more hazardous downstream skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description frames the skill as simple skill compression, while the body also documents provider discovery, feedback collection, and persistent learning-state management. This scope mismatch can mislead users and reviewing systems about what the skill may do, reducing informed consent and increasing the chance that side-effecting behavior is approved under a narrower trust assumption.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs provider auto-detection by executing a local command (ollama list) and checking environment variables such as GEMINI_API_KEY and OPENAI_API_KEY. For a skill presented as a compression/distillation helper, this expands capability into host inspection and secret-presence probing that is not necessary to describe the compression logic itself, increasing the attack surface and creating privacy/security concerns if invoked automatically.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill specifies persistent logging of compression runs to .learnings/skill-distiller/calibration.jsonl, including timestamps, skill names, token counts, and other user-derived metadata. Persistent state unrelated to core compression can leak sensitive project information over time, create unintended data retention, and enable cross-session profiling without clear necessity or nearby consent language.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrase is broad enough that ordinary user requests to 'compress' or 'reduce' content could activate this skill outside its intended scope. In an agent environment, that can cause unintended routing or invocation, leading the system to transform unrelated content or bypass more appropriate skills, though the skill itself is not overtly harmful.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill’s stated purpose is documentation/compression, but it also instructs the agent to persist calibration and feedback data to local files. That creates a hidden stateful side effect and retention of user-provided metadata/outcomes that is not necessary for basic compression and may expose sensitive content over time.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · test_integration.sh (reported line 28)May include surrounding context.

sh

# Test 1: Section Classification (using real skill)
echo "Test 1: Section Classification"
SECTION=$(head -50 "$PBD_SKILLS/essence-distiller/SKILL.md" | grep -A3 "## When to Use")
RESULT=$(ollama run $MODEL "Classify this skill section as TRIGGER, CORE_INSTRUCTION, or EXAMPLE:
$SECTION
Respond with just the type.")

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · test_integration.sh (reported line 45)May include surrounding context.

sh

# Test 3: Protected Pattern Detection (real agentic skill)
echo "Test 3: Protected Pattern Detection (failure-memory)"
if [[ -f "$AGENTIC_SKILLS/failure-memory/SKILL.md" ]]; then
  grep -E "(N=1|N=2|N≥3|N-count)" "$AGENTIC_SKILLS/failure-memory/SKILL.md" > /dev/null && \
    echo "  PASS: N-count patterns found in failure-memory" || \
    echo "  FAIL: No N-count patterns found"

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · test_integration.sh (reported line 46)May include surrounding context.

sh

# Test 3: Protected Pattern Detection (real agentic skill)
echo "Test 3: Protected Pattern Detection (failure-memory)"
if [[ -f "$AGENTIC_SKILLS/failure-memory/SKILL.md" ]]; then
  grep -E "(N=1|N=2|N≥3|N-count)" "$AGENTIC_SKILLS/failure-memory/SKILL.md" > /dev/null && \
    echo "  PASS: N-count patterns found in failure-memory" || \
    echo "  FAIL: No N-count patterns found"

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · test_integration.sh (reported line 55)May include surrounding context.

sh

# Test 4: Advisory Pattern Detection (real agentic skill)
echo "Test 4: Advisory Pattern Detection (workflow-tools)"
if [[ -f "$AGENTIC_SKILLS/workflow-tools/SKILL.md" ]]; then
  grep -E "(SERIAL|parallel|checkpoint)" "$AGENTIC_SKILLS/workflow-tools/SKILL.md" > /dev/null && \
    echo "  PASS: Parallel/serial patterns found in workflow-tools" || \
    echo "  FAIL: No parallel/serial patterns found"

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · test_integration.sh (reported line 56)May include surrounding context.

sh

# Test 4: Advisory Pattern Detection (real agentic skill)
echo "Test 4: Advisory Pattern Detection (workflow-tools)"
if [[ -f "$AGENTIC_SKILLS/workflow-tools/SKILL.md" ]]; then
  grep -E "(SERIAL|parallel|checkpoint)" "$AGENTIC_SKILLS/workflow-tools/SKILL.md" > /dev/null && \
    echo "  PASS: Parallel/serial patterns found in workflow-tools" || \
    echo "  FAIL: No parallel/serial patterns found"

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · test_integration.sh (reported line 73)May include surrounding context.

sh

# Test 7: Stress Test (largest skill)
echo "Test 7: Stress Test (context-verifier, 419 lines)"
if [[ -f "$AGENTIC_SKILLS/context-verifier/SKILL.md" ]]; then
  LINES=$(wc -l < "$AGENTIC_SKILLS/context-verifier/SKILL.md")
  echo "  Found context-verifier: $LINES lines"
  [[ $LINES -ge 400 ]] && echo "  PASS: Stress test fixture available" || echo "  INFO: File smaller than expected"

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · test_integration.sh (reported line 74)May include surrounding context.

sh

# Test 7: Stress Test (largest skill)
echo "Test 7: Stress Test (context-verifier, 419 lines)"
if [[ -f "$AGENTIC_SKILLS/context-verifier/SKILL.md" ]]; then
  LINES=$(wc -l < "$AGENTIC_SKILLS/context-verifier/SKILL.md")
  echo "  Found context-verifier: $LINES lines"
  [[ $LINES -ge 400 ]] && echo "  PASS: Stress test fixture available" || echo "  INFO: File smaller than expected"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The 'When to Use' section lists only 'test error handling' as a trigger phrase, but provides no scope, constraints, or exclusion conditions. In a markdown skill file, this is ambiguous because it does not clearly define when the skill should activate versus when it should not.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README documents that calibration data is persisted to .learnings/skill-distiller/calibration.jsonl, but it does not clearly warn users that running the skill creates a local history file. In agent environments, persistent artifacts can unintentionally store prompts, filenames, outcomes, or workflow metadata that users may not expect to retain, creating a transparency and privacy issue even if the file is local-only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The calibration section describes writing user-provided compression metadata to disk but does not place a clear user-facing warning adjacent to the behavior. Even if the data seems operational, silent persistence can surprise users, violate expectations for ephemeral processing, and capture sensitive contextual metadata such as skill names and usage history.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs appending calibration data to .learnings/skill-distiller/calibration.jsonl, which modifies the user's workspace without an accompanying warning, confirmation step, or opt-in control in the skill text. Although the write target appears local and related to the skill's functionality, silent file creation or mutation can still surprise users, pollute repositories, and persist potentially sensitive prompt/output metadata.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The data-handling statement implies a narrow trust-boundary model and no meaningful side effects beyond model usage, but elsewhere the skill documents local persistence of calibration data. This mismatch can mislead users about retention and processing, undermining informed consent and increasing privacy risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill's stated role is to help users compress verbose skills, but the reference documentation includes provider auto-detection via ollama list and inspection of GEMINI_API_KEY and OPENAI_API_KEY. Those environment and runtime capability checks are operational concerns not clearly disclosed by the compression-centric description, even though they support model selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill describes persistent logging of compression runs and later feedback updates without a clear warning that user-supplied skill names, metadata, token counts, and outcomes may be retained on disk. Even if not overtly malicious, silent retention can accumulate sensitive operational or proprietary information and create compliance/privacy issues.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.