The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, including web search results (Brave Search, Tavily) and GitHub repositories, during its Intelligence Gathering phase. This data informs high-stakes decision-making roles, creating an attack surface where instructions embedded in external content could manipulate the agent's logic.
Ingestion points: Phase 0 queries external tools such as brave-search, tavily, and github to build an Intelligence Brief.
Boundary markers: While data is compiled into a brief, there are no specific instructions to use delimiters or ignore embedded directives within the gathered text.
Capability inventory: The skill possesses extensive capabilities, including writing local files, creating Obsidian notes, updating semantic memory, and sending external messages via the hermes MCP.
Sanitization: The instructions do not define any sanitization or validation protocols for the external data before it is processed by the advisors.
[DATA_EXFILTRATION]: The skill is designed to collect context from the local filesystem and project memory and can transmit this data to external messaging platforms.
Evidence: The workflow in references/council-workflow.md describes reading ~/.claude/projects/*/memory/MEMORY.md and using the hermes MCP to send messages to Telegram, Discord, or Slack. Although the skill specifies asking the user before sending, the underlying capability to move local data to external network services is present.
[COMMAND_EXECUTION]: The skill requires the agent to perform directory management and file writing operations on the local host.
Evidence: The protocol mandates saving HTML reports to ~/.claude/council-reports/ using the system's Write tools, which involves direct interaction with the local filesystem structure.

council