agent-council

Pass

Audited by Gen Agent Trust Hub on Jul 15, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands for system maintenance and installation. In scripts/bootstrap.py, it uses subprocess.run to install the package via pip or pipx. In agent_council/phases/select.py, it uses git to update submodules containing agent profiles. These operations are scoped to the skill's own directory and standard development workflows.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves professional agent profiles from a public GitHub repository (hermes-profiles) using Git submodule updates. It also defines dependencies on standard libraries like pydantic-ai and pyyaml.
  • [CREDENTIALS_UNSAFE]: Secret management follows industry best practices. The skill loads API keys from environment variables or a local .env file and maps them to standard provider-specific environment variables (e.g., OPENAI_API_KEY).
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 15, 2026, 03:08 AM
Security Audit — agent-trust-hub — agent-council