The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and synthesize responses from external AI models (ChatGPT and Gemini), creating an attack surface for indirect prompt injection.
Ingestion points: The script scripts/query_llms.py fetches responses from external LLM APIs and CLI tools, which are then passed back to the agent context.
Boundary markers: Absent. The instructions do not specify any delimiters or safety prompts to prevent the agent from being influenced by instructions embedded within the external model responses.
Capability inventory: The skill is used to generate implementation plans. While the skill itself doesn't call file-write or subprocess tools in its synthesized output, the agent's synthesis of malicious advice into a plan could lead to harmful actions if the user or agent follows them.
Sanitization: None. The script retrieves raw text from the external models and returns it as a JSON structure to the agent.
[COMMAND_EXECUTION]: The scripts/query_llms.py script executes external CLI tools using the subprocess module.
Evidence: The script calls subprocess.run(["gemini", "-p", prompt]) and subprocess.run(["codex", "-p", prompt]) where prompt is derived directly from user input.
Analysis: While the script correctly uses a list of arguments to avoid shell injection, the direct passing of user input to CLI flags can be a vector for argument injection if the target binaries (gemini/codex) have exploitable parameters.

llm-council