The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external CLI tools (Codex, Claude Code, and Antigravity) via a Node.js runner. It uses node:child_process.spawn with shell: false and windowsHide: true. This configuration is a security best practice that prevents shell injection by ensuring arguments are not interpreted by a command shell. Executables are limited to a hardcoded whitelist (codex, claude, agy).
[INDIRECT_PROMPT_INJECTION]: As the skill's primary function is to ingest and synthesize data from external AI agents, it is naturally exposed to indirect prompt injection. However, it implements comprehensive countermeasures: it includes explicit instructions in its synthesis rules to treat all council drafts as untrusted analysis data, warns against executing any instructions found within those drafts, and applies sanitization to the outputs.
[DATA_EXFILTRATION]: The skill proactively prevents data exposure and exfiltration through two layers of redaction. First, the childEnvironment function filters out sensitive environment variables (API keys, tokens, secrets) and prevents library injection attacks by blocking variables like LD_PRELOAD and DYLD_INSERT_LIBRARIES. Second, a redact function uses regular expressions to detect and mask common secret patterns (OpenAI keys, Google Cloud keys, Bearer tokens) in text before it is recorded to the local run directory.
[DYNAMIC_EXECUTION]: The skill uses dynamic imports to load service-specific adapters. This is implemented safely by using a hardcoded list of provider IDs and fixed path templates, preventing any path traversal or arbitrary code loading.

agent-council