llm-council

Pass

Audited by Gen Agent Trust Hub on Jun 17, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it automatically ingests and processes untrusted data from various workspace files without sanitization.\n
  • Ingestion points: Scans for and reads context from CLAUDE.md, the memory/ folder, and other user-referenced files in the workspace to enrich advisor prompts.\n
  • Boundary markers: Lacks instructions for advisors to ignore potentially malicious commands or use robust delimiters for external context data.\n
  • Capability inventory: Spawns multiple sub-agents, reads local files using Read, discovers files with Glob, and writes outputs to the filesystem.\n
  • Sanitization: Workspace file content is directly interpolated into the advisor framing prompt without validation or escaping.\n- [COMMAND_EXECUTION]: The skill directs the agent to perform local filesystem operations and open generated files.\n
  • Evidence: Instructs the use of Glob and Read tools for data harvesting and specifies that the agent should open the final HTML report file after generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 17, 2026, 04:24 PM
Security Audit — agent-trust-hub — llm-council