council-execution
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local bash script
run-council.shlocated within the plugin root directory to coordinate calls to various AI providers. It includes instructions to use the--separator to prevent flag injection from user-provided prompt text. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data generated by external AI providers, creating a potential injection surface.
- Ingestion points: Reads responses from external models (Gemini, OpenAI, etc.) stored in the
.claude/council-cache/directory. - Boundary markers: Includes instructions to display provider responses verbatim and uses specific markdown headers to separate data from the synthesis.
- Capability inventory: Utilizes the Bash tool for execution and the Read tool for accessing cached responses and synthesis templates.
- Sanitization: No explicit sanitization or filtering of the external AI model outputs is performed before they are synthesized by the agent.
Audit Metadata