The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/cmux_council.py script executes the cmux binary using subprocess.run to relay messages to interactive terminal sessions.
Evidence: The run_cmux function in scripts/cmux_council.py executes commands with shell=False. Input parameters such as surface_id are strictly sanitized using a regular expression (SAFE_TOKEN) in the require_token function to prevent command injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes outputs from multiple AI models, which is an inherent attack surface for indirect prompt injection if one model provides malicious instructions to subsequent stages like the organizer or synthesizer.
Ingestion points: Model responses are ingested in scripts/council_state.py via the reconcile function, which reads artifact files produced by execution runners or the cmux relay.
Boundary markers: The skill enforces strict JSON schemas for every stage of the council (e.g., opening-answer.schema.json, organizer-analysis.schema.json). All responses are validated against these schemas before being processed further.
Capability inventory: The skill is restricted to read-only tool profiles (no_tools, repo_read_only, research_read_only) and can write session state/artifacts only to the local filesystem under .ai-workflow/consensus/.
Sanitization: Responses are parsed as JSON and validated using the output_contract.py shared utility, ensuring that only expected structured data is processed.

models-consensus