The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a multi-stage evaluation where data from one stage (model answers) is fed into the prompt for the next stage (judging and chairman synthesis). It also interpolates 'persona lenses' (e.g., Feynman, Taleb) from a configuration file into stage-1 prompts. This creates a surface for indirect prompt injection if the inputs are not strictly delimited or if a model's answer contains malicious instructions intended to influence the judge or chairman.
Ingestion points: answers.json (Stage 2b), judges.json (Stage 2c), and persona descriptions from harness/council.personas.yaml (Stage 1).
Boundary markers: The skill documentation does not specify the use of delimiters or 'ignore embedded instructions' warnings when interpolating these values into prompts.
Capability inventory: File system writes to scratchpad/ and llmwiki/, and execution of the orca orchestration CLI.
Sanitization: The skill mentions using html.escape specifically for the Stage-4 HTML report rendering to prevent HTML injection, but does not specify sanitization for the prompt construction phase.
[COMMAND_EXECUTION]: The orchestration protocol relies on shell command patterns that interpolate variables, such as orca orchestration task-create --spec "Answer: <question>". If user-provided questions or other variables are not properly escaped before being passed to the shell, it could lead to command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The documentation references external resources and persona data from GitHub repositories, specifically github.com/karpathy/llm-council and github.com/0xNyk/council-of-high-intelligence. These represent external dependencies that influence the skill's logic and data roster.

council