council
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input in the form of a 'dilemma' and interpolates it directly into instructions for sub-agents without sufficient isolation or sanitization.\n
- Ingestion points: The dilemma and its constraints are captured in Step 1 and passed to all archetype sub-agents during the Opening Statements (Step 3) and Rebuttal (Step 4) phases.\n
- Boundary markers: The instructions do not define delimiters (such as XML tags, triple backticks, or specific markers) to wrap the user-provided dilemma, which could allow malicious input to bleed into and override the sub-agent instructions.\n
- Capability inventory: The facilitator agent is granted use of a
subagent/task toolto spawn multiple sub-processes, which could be targeted by a malicious dilemma aimed at sub-agent hijacking.\n - Sanitization: There is no evidence of logic to filter, escape, or validate the user-supplied dilemma content before it is processed by the agent runtime.
Audit Metadata