engineering-council
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill implements a 'Discovery' phase (described in SKILL.md Step 3) where subagents read files from the local repository to ground the council's reasoning in the actual codebase. This is an intended architectural feature for repository-aware technical reviews.
- [PROMPT_INJECTION]: The skill's discovery pass introduces a surface for indirect prompt injection if the repository being analyzed contains untrusted or malicious content. The author explicitly documents this in the README and SKILL files, stating that the skill assumes a trusted repository environment.
- [EXTERNAL_DOWNLOADS]: The README provides installation instructions using a standard package manager command pointing to the author's public GitHub repository (github.com/belsrc/skills).
Audit Metadata