council
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an orchestration pattern where a primary agent collects, summarizes, and acts upon outputs from multiple subagents ('delegates') across different model providers. This structure is inherently vulnerable to indirect prompt injection if a subagent's response—potentially influenced by malicious instructions within the codebase being reviewed—tricks the primary agent into performing unauthorized actions.
- Ingestion points: The agent ingests feedback and scores from three separate model delegates and reads relevant codebase context (referenced in SKILL.md).
- Boundary markers: The instructions lack specific delimiters or guardrail prompts to help the agent distinguish between trusted instructions and potentially biased or malicious subagent output.
- Capability inventory: The skill authorizes the agent to spawn subagents (
delegate_task), modify pull request descriptions, and execute filesystem changes ('make the changes') based on delegate recommendations. - Sanitization: There are no specified procedures for sanitizing or validating delegate findings before they are utilized to automate code changes or summarize instructions for the user.
Audit Metadata