The Agent Skills Directory

[METADATA_POISONING]: The skill metadata (SKILL.md) identifies the author as 'DAIR.AI' and describes the source as 'official', which contradicts the identified skill author 'sickn33'. This inconsistency can lead to misjudgment of the skill's origin and trust level.
[INDIRECT_PROMPT_INJECTION]: The core council-of-models architecture processes untrusted outputs from multiple LLMs as inputs to other LLMs, creating a surface for injection attacks.
Ingestion points: Phase 2 and Phase 3 scripts in references/detailed-guide.md ingest outputs from Phase 1 (independent model responses).
Boundary markers: The scripts use basic text-based delimiters (e.g., === Response A === or [Model Name's Rankings]) to separate inputs.
Capability inventory: The skill has access to Bash, allowing it to execute scripts that perform Network requests to Fireworks AI and Write session data to the /tmp directory.
Sanitization: There is no evidence of escaping, filtering, or validation of the content generated by the participant LLMs before it is interpolated into the prompts for the ranking and synthesis models.
[DYNAMIC_EXECUTION]: The skill relies on complex Python scripts defined within markdown files that are executed dynamically via shell here-docs (python3 << 'PYEOF'). These scripts orchestrate the multi-phase API interaction and local file management.
[COMMAND_EXECUTION]: The workflow extensively uses the Bash tool to perform environment variable checks, manage local session directories in /tmp, and execute the Python orchestration scripts.

llm-council