ask-council
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided input through the
$ARGUMENTSplaceholder and relays it to subagents (consultant:consultant) via the Task tool. This setup lacks boundary markers or sanitization, creating a surface for indirect prompt injection where malicious instructions in the user input could potentially influence the subagents' behavior.\n - Ingestion points: User-supplied input passed through the
$ARGUMENTSvariable inSKILL.md.\n - Boundary markers: The instructions do not define any delimiters (e.g., XML tags, triple backticks) to separate untrusted user input from system-level task descriptions.\n
- Capability inventory: The skill uses the
Tasktool to invoke multiple subagents in parallel, which is the primary execution capability.\n - Sanitization: There are no instructions for filtering, escaping, or validating the user input before it is interpolated into the prompt for the subagents.
Audit Metadata