llm-council
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it automatically ingests and processes untrusted data from various workspace files without sanitization.\n
- Ingestion points: Scans for and reads context from
CLAUDE.md, thememory/folder, and other user-referenced files in the workspace to enrich advisor prompts.\n - Boundary markers: Lacks instructions for advisors to ignore potentially malicious commands or use robust delimiters for external context data.\n
- Capability inventory: Spawns multiple sub-agents, reads local files using
Read, discovers files withGlob, and writes outputs to the filesystem.\n - Sanitization: Workspace file content is directly interpolated into the advisor framing prompt without validation or escaping.\n- [COMMAND_EXECUTION]: The skill directs the agent to perform local filesystem operations and open generated files.\n
- Evidence: Instructs the use of
GlobandReadtools for data harvesting and specifies that the agent should open the final HTML report file after generation.
Audit Metadata