The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill makes network requests to 'https://api.fireworks.ai/inference/v1/chat/completions' using the Python 'requests' library to interact with LLM models. These are documented interactions with a well-known service provider.
[COMMAND_EXECUTION]: The skill uses Python heredocs ('python3 << 'PYEOF'') within Bash blocks to execute multi-step logic for Phase 1 (Responses), Phase 2 (Ranking), and Phase 3 (Synthesis). This is used for local workflow automation.
[DATA_EXFILTRATION]: While the skill communicates with Fireworks AI, it does so to send the user's query and retrieve model responses. It does not attempt to access or exfiltrate sensitive local files like SSH keys or AWS credentials. It specifically warns users to export their 'FIREWORKS_API_KEY' in their shell profile, which is a common but sensitive configuration step.
[INDIRECT_PROMPT_INJECTION]: The 'Chairman' model in Phase 3 processes outputs from other models (Phase 1) and their rankings (Phase 2). This creates a surface where one model's output could contain instructions designed to manipulate the Chairman's synthesis.
Ingestion points: Phase 3 script reads 'phase1_responses.json' and 'phase2_rankings.json' which contain untrusted LLM outputs.
Boundary markers: The prompt uses labels ('=== Response A ===') but lacks explicit 'ignore embedded instructions' delimiters for the aggregated content.
Capability inventory: The skill performs file writes to '/tmp/llm-council/' and network POST requests to Fireworks AI.
Sanitization: No visible sanitization or filtering of the content from Phase 1/2 is performed before interpolation into the Phase 3 prompt.

llm-council