watch — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited watch (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- Trigger phrases: watch, /watch list, /watch add <url>, /watch remove <url>, show my sources, add feed source, remove feed source -->
Lists, adds, and removes feed sources that Distillery monitors for ambient intelligence. Changes are persisted to the database and survive server restarts. Sources defined in distillery.yaml are seeded into the database on first startup.
/watch list)/watch add <url>)/watch remove <url>)See CONVENTIONS.md — skip if already confirmed this conversation.
| Invocation pattern | Action | Extra args |
|---|---|---|
/watch or /watch list | list | none |
/watch add <url> [--type TYPE] [--label LABEL] | add | url, optional source_type, label |
/watch remove <url> [--purge] | remove | url, optional purge (requires explicit confirmation before purge) |
Default to list if no subcommand is recognizable.
For add, parse:
rss). Valid: rss, github, hackernews, webhookreleases (default — one body-bearing entry per release with the changelog notes) or events (opt-in contentless events firehose). The default releases mode is the high-signal "what shipped" surface.If add is requested without a URL, ask the user before proceeding.
Call distillery_watch with the parsed arguments:
distillery_watch(action="list")distillery_watch(action="add", url=..., source_type=..., label=..., poll_interval_minutes=..., trust_weight=..., mode=...) (mode is github-only; omit for rss)distillery_watch(action="remove", url="<url>")--purge will archive all historic entries previously ingested from <url>. This skill's allowlist only includes mcp__*__distillery_watch, so the exact count cannot be fetched here — describe the impact in-prompt instead of issuing a distillery_list call.<url>? This cannot be undone without re-ingesting. [yes/no]").yes), call distillery_watch(action="remove", url="<url>", purge=true). Report the archived count returned by the tool when confirming to the user.add only)After a successful add, remind the user about routine-based polling.
If no feed poll routine is configured, display:
No feed poll routine found. Run /setup to configure scheduled routines.If the user already has routines configured (they confirm when asked), skip to Step 5.
Source table format (used for list and after add/remove):
Feed Sources (N configured)
| # | URL | Type | Label | Poll (min) | Trust |
|---|-----|------|-------|-----------|-------|
| 1 | https://example.com/rss | rss | Example | 60 | 1.0 |If no sources: show "No feed sources configured." with usage hint.
--purge was used, also report the number of archived entriesChanges are persisted to the database automatically — no manual YAML editing required.
list when no arguments are providedsource_type is one of: rss, github, hackernews, webhookadd without a URLadd or removeadd, remind the user to run /setup if no feed poll routine is configured~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.