local-council-execution
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by interpolating untrusted data directly into subagent prompts and shell command arguments.
- Ingestion points: User-provided questions, file content (via
--fileor auto-context), and the--rolescommand-line argument are ingested inSKILL.md(Step 1, Step 2) andagent-prompt-template.md. - Boundary markers: The subagent prompt template in
agent-prompt-template.mddoes not employ delimiters (such as XML tags or explicit block markers) to isolate untrusted{QUESTION_WITH_CONTEXT}from the system instructions. - Capability inventory: The skill utilizes the
bashtool to execute local plugin scripts, spawns multiplegeneral-purposesubagents with background execution capabilities, and performs file system writes to a local cache directory (.claude/council-cache/). - Sanitization: No explicit validation, escaping, or sanitization is performed on the user-supplied role list or context strings before they are interpolated into shell commands (e.g.,
local_council_roles "<--roles value>") or subagent prompts.
Audit Metadata