council
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a custom Rust-based CLI tool (source code provided in the
tools/directory) that executes the external utilityyt-dlp. This is used to download subtitles from YouTube for the purpose of distilling personas. - [EXTERNAL_DOWNLOADS]: The skill frequently fetches data from external sources, primarily YouTube and general web searches, during its 'distillation' phase to gather research material for its persona files.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves synthesizing system instructions (personas) from untrusted data gathered at runtime.
- Ingestion points: Research data is ingested from arbitrary web search results and YouTube transcripts, as defined in
references/agent-prompts.mdand processed by thecounciltool intools/src/main.rs. - Boundary markers: The system uses markdown headers and YAML frontmatter as delimiters in the
persona-template.md, which are used by sub-agents to structure distilled information. - Capability inventory: The skill uses the
Writetool to save information to the local file system and can execute shell commands through its internal Rust helper. - Sanitization: While
tools/src/main.rscontains regex logic to clean subtitle timestamps and HTML tags from transcripts, it does not specifically filter or sanitize the content for adversarial instructions that could influence the agent's behavior during distillation or in subsequent 'roundtable' sessions.
Audit Metadata