council-review
Warn
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to automatically execute shell commands (
~/bin/validate-plan,~/bin/review) when writing plans to~/.claude/plans/or before marking a pull request as done. Automated execution of local binaries increases the risk if these tools are misconfigured or replaced by a malicious actor. - [PROMPT_INJECTION]: The skill contains deceptive instructions and metadata regarding a "Claude Fable 5" model with a future GA release date of "2026-06-09". This misinformation can influence the agent's behavior, leading it to rely on hallucinated model capabilities or follow invalid validation protocols.
- [DATA_EXFILTRATION]: The instructions direct the agent to perform network requests via
POST /api/models/health. Without a specified trusted domain, this network capability could be used for data exfiltration or to interact with unauthorized external endpoints. - [PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by processing external, untrusted content (plan files and pull request changes) through automated review tools without explicit boundary markers or sanitization.
- Ingestion points: Files located in
~/.claude/plans/and PR changed files. - Boundary markers: Absent; the skill does not instruct the agent to use delimiters or ignore instructions within the reviewed data.
- Capability inventory: Shell command execution via the Bash tool and file reading via the Read tool.
- Sanitization: No sanitization, escaping, or validation of the plan/file content before processing is mentioned.
Audit Metadata