The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it automatically ingests data from the local workspace to provide context to its sub-agents.
Ingestion points: The skill uses Glob and Read tools to scan for files such as CLAUDE.md, the memory/ folder, and other project-related context files in Step 1.
Boundary markers: The instructions use --- delimiters to wrap the framed question in advisor prompts, but they do not explicitly instruct the agents to ignore instructions embedded within the ingested context.
Capability inventory: The skill possesses capabilities for file listing (Glob), file reading (Read), file writing (Write), and spawning independent sub-agents.
Sanitization: There is no evidence of sanitization or filtering of the workspace content before it is interpolated into the prompts for the council advisors or reviewers.
[COMMAND_EXECUTION]: The skill logic involves generating an HTML report and instructs the agent to open the resulting file.
Evidence: Step 5 in SKILL.md describes the generation of council-report-[timestamp].html and explicitly commands the agent to "Open the HTML file after generating it."
Risk: Since the report synthesizes responses that include data ingested from the workspace, there is a risk of Cross-Site Scripting (XSS) or HTML injection if malicious content in the workspace is written to the report without proper escaping.
[EXTERNAL_DOWNLOADS]: The documentation in the README.md provides installation instructions that involve a git clone operation from a third-party GitHub repository (github.com/tenfoldmarc/llm-council-skill).

llm-council