council-execution
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local bash script (
run-council.sh) located within the plugin's scripts directory to manage the multi-provider query pipeline. - [INDIRECT_PROMPT_INJECTION]: The skill functions as an aggregator that reads and synthesizes responses from external AI models. This process involves the ingestion of untrusted data which could theoretically contain instructions intended to influence the agent.
- Ingestion points: The skill reads provider outputs from cached files in
.claude/council-cache/. - Boundary markers: The instructions emphasize the use of separator lines (
---) and specific emoji prefixes for each provider (e.g., 🟦 Gemini) to maintain clear separation. - Capability inventory: The skill can execute local bash scripts and read files from the plugin directory.
- Sanitization: No explicit sanitization or filtering of the external provider outputs is specified beyond verbatim display requirements.
Audit Metadata