council
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill ingests data from codebase files, snippets, and issue trackers to provide context for subagents, which presents a surface for indirect prompt injection.
- Ingestion points: Relevant files, snippets, issue text, and metrics (SKILL.md).
- Boundary markers: The subagent prompt template uses explicit 'Question:' and 'Context:' headers to delimit external data.
- Capability inventory: Launching subagents and interacting with external tools like 'knowledge-ops' and GitHub/Linear.
- Sanitization: No specific sanitization or instructions to ignore instructions within the context are provided.
- [SAFE]: The skill mandates context isolation by providing subagents with only the immediate task and relevant snippets, which serves as a security control against cross-session prompt manipulation.
- [SAFE]: Explicitly prohibits writing to ad-hoc or shadow paths like '~/.claude/notes', ensuring that all durable decisions are stored via approved and auditable channels.
Audit Metadata