B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
AI agent skill · General
distilly
Distilly — Distill how they think into reusable Skills for any Agent or Bot. Formerly Colleague Skill（原同事 Skill）.
Bottom line: Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
- Popularity score
- 49/100
- Rank
- #135 of 500
- GitHub stars
- 25.7k
What it does
Distilly captures how team members think and work, then converts those patterns into reusable Skills that can be deployed across AI agents and bots. It enables you to codify human expertise and decision-making logic once, then apply it consistently across multiple autonomous systems.
Who it’s for
Engineering teams and enterprises looking to standardize agent behavior and knowledge transfer. Product builders who want to package expert workflows as repeatable, composable AI skills.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/titanwings/distilly (opens external site) for current installation. Likely npm-based: npm install distilly or clone and follow local setup instructions. Check for agent integration examples (Claude, n8n, etc.) in the repository documentation.
Risks
- Expertise leakage: Distilled skills may encode proprietary workflows, decision rules, or domain knowledge that become portable and harder to control once deployed across agents.
- Prompt injection via skill parameters: If skills accept user input, malicious prompts could manipulate agent behavior or bypass intended constraints.
- Incomplete context capture: Distilling human thinking may omit ethical guardrails, edge-case handling, or risk mitigation that humans apply intuitively.
- Supply-chain risk: Low weekly npm adoption and relatively young project (0 weekly downloads observed) suggests limited security auditing and community vetting.
- Skill versioning and drift: No clear visibility into how skills are versioned, validated, or updated; outdated or corrupted skills could propagate across agents silently.
How to stay secure
Least-privilege permissions
- Restrict skill export/import to authenticated, authorized users only; implement role-based access control (RBAC) for skill creation and deployment.
- Run agents executing distilled skills in sandboxed environments with minimal capability grants; prohibit direct file system, credential, or external API access unless explicitly whitelisted per skill.
- Validate and sanitize all skill parameters at runtime; implement strict input schemas and reject or escape user-supplied values that could modify skill logic or prompts.
Network isolation
- Deploy skill repositories and agent execution on air-gapped or VPC-isolated infrastructure; restrict outbound connections to pre-approved endpoints only.
- Use read-only mounts for skill definitions; prevent agents from modifying, downloading, or hot-swapping skills at runtime without cryptographic verification.
- Require mutual TLS authentication and signed checksums for all skill transfers between agents, repositories, and execution environments.
Monitoring
- Log and audit every skill creation, modification, deployment, and execution with full parameter capture and user attribution; flag unusual version changes or rollbacks.
- Monitor agent behavior for anomalies: unexpected API calls, token usage spikes, or outputs inconsistent with skill intent; correlate with skill versions and user actions.
- Implement integrity checks and version pinning; alert on mismatches between deployed and signed skill checksums, or unauthorized updates to skill definitions.
Red flags to watch for
- Skills that encode credentials, API keys, or proprietary logic directly; require external secret management and code review before deployment.
- Distilled skills with vague, overly broad decision rules or missing error handling and compliance checks; reject skills lacking human-reviewed documentation of edge cases and constraints.
- Sudden skill version proliferation, unsigned updates, or skills from untrusted sources; enforce mandatory security scanning, SBOM generation, and maintainer verification before adoption.
Alternatives
- Anthropic's Prompt Caching + Tool Use — Use Claude's native tools and function calling to encode workflows without an external skill abstraction layer.
- LangChain / LlamaIndex Agent Toolkits — Framework-level abstractions for composing agent behaviors with built-in testing and observability.
- n8n Workflows — Visual, auditable workflow composition with version control and permission scoping.
- Hugging Face Transformers + LoRA fine-tuning — Train domain-specific model adapters instead of distilling behavior into prompts.