llm-council

SUSPICIOUS. The core behavior mostly matches the stated orchestration purpose, and the scanner's backtick/.config findings are largely benign documentation artifacts. The main risk is scope expansion: the skill can execute arbitrary user-configured custom commands and forwards task/codebase data to external CLIs selected from local config, while relying on repo-local setup/execution scripts without strong provenance details in the skill itself. Not confirmed malicious, but broader and riskier than a narrowly scoped planning helper.

No direct evidence of embedded malware (no backdoor, keylogging, cryptomining, or remote exfiltration code). However, the code has a high-risk security property: it executes commands built from agent configuration (including custom commands via shlex.split(config.command) passed straight to subprocess.Popen). If an attacker can influence the config or UI actions, this can lead to arbitrary code execution on the host. Additionally, the claude invocation uses '--dangerously-skip-permissions', further reducing safety assumptions of the external CLI tool integration.