council
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and processing content from external sources (GitHub PRs, Notion pages, and general URLs), which constitutes an indirect prompt injection attack surface. \n
- Ingestion points: Data is collected in Step 2 using the
ghCLI for Pull Requests, Notion MCP for pages, andWebFetchfor general URLs. \n - Boundary markers: The skill implements defensive delimiters (
<council-review-content>) to separate untrusted content from the agent's core instructions. \n - Capability inventory: The skill has the ability to read local files, execute CLI commands for version control, perform web fetches, and invoke subagents. \n
- Sanitization: In Step 5, the skill explicitly instructs subagents to treat delimited content as data only and includes a requirement to warn users about potential risks when analyzing untrusted external material.
Audit Metadata