new-llm-council

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill clones one of the public template repos (e.g., danielrosehill/LLM-Council-Grounded) and then the agent will later read/edit files from that cloned content (README/config/prompts), which are outsider-authored free text that becomes LLM-readable in the working directory and thus can be injected into the agent’s LLM context during subsequent steps.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The workflow clones remote GitHub template repositories at runtime (e.g. https://github.com/danielrosehill/LLM-Council-Template) and uses their files (system prompts, config, and code) to scaffold and control the agent's prompts and runtime behavior, so the fetched content directly controls prompts/code.