Council

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:44 AM UTC
• Version: 0.1.0

Overview

The skill matches its stated council-deliberation purpose, but every council persona is given broad file, shell, and web access without clear limits or user-control guardrails.

Review before installing. This package appears to be a deliberation aid, but only install it in an environment where you are comfortable with its council agents potentially having access to readable local files, shell commands, and outbound web tools. For safer use, remove Bash/WebSearch/WebFetch from personas that do not need them, use a sandboxed workspace, and avoid giving it untrusted repository content or prompts unless tool use is tightly controlled.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: agents/council-sun-tzu.md:6
• Finding: Overbroad Shell, Filesystem, and Network Permissions Granted to All Council Agents## Vulnerability Details **File Location**: `agents/council-ada.md:6`, `agents/council-aristotle.md:6`, `agents/council-aurelius.md:6`, `agents/council-feynman.md:6`, `agents/council-lao-tzu.md:6`, `agents/council-machiavelli.md:6`, `agents/council-musashi.md:6`, `agents/council-socrates.md:6`, `agents/council-sun-tzu.md:6`, `agents/council-torvalds.md:6`, and `agents/council-watts.md:6` **Vulnerability Type**: Excessive tool permissions and violation of least privilege **Risk Level**: Medium **Complete vulnerable code snippet**: ```yaml tools: ["Read", "Grep", "Glob", "Bash", "WebSearch", "WebFetch"] ``` The same tool declaration appears at line 6 in every listed agent definition. ### Technical Analysis All 11 council personas receive local file-reading, unrestricted shell-execution, search, and network-fetch capabilities. Their declared function is primarily to perform textual analysis from different intellectual perspectives. Most of that functionality does not inherently require command execution or network access. The combination is security-sensitive: - `Read`, `Grep`, and `Glob` can inspect files available to the agent's operating-system account. - `Bash` can execute commands with the permissions of the Claude Code process. - `WebSearch` and `WebFetch` provide outbound network channels. - Together, these tools can form an access-and-egress chain if an untrusted problem statement, repository document, or retrieved page contains instructions that influence the agent. The agent definitions contain no path restrictions, command allowlist, outbound-domain allowlist, or requirement to obtain explicit user approval before using these capabilities. Consequently, the permission set exceeds the minimum privileges needed for persona-based deliberation. The static pre-scan specifically identified `agents/council-sun-tzu.md`. Direct inspection found no URL, upload command, secret-collection logic, or explicit instruction to t ...[truncated 1753 chars]
• Remediation: ## Remediation Suggestions 1. Remove `Bash`, `WebSearch`, and `WebFetch` from personas whose duties are limited to conceptual analysis. 2. Default purely deliberative personas to no tools, or grant only narrowly required read-only tools. 3. If repository analysis is required, constrain `Read`, `Grep`, and `Glob` to the active workspace and explicitly exclude home-directory credentials, SSH material, environment files, and system configuration. 4. Require explicit user confirmation before any shell command or outbound network request. 5. Apply command allowlists and sandboxing to any agent that genuinely requires `Bash`. 6. Restrict outbound requests to approved domains and prohibit placing local file contents, credentials, tokens, or user data in URLs or request bodies. 7. Treat problem statements, repository files, other agents' output, and fetched web content as untrusted data rather than executable instructions. 8. Separate local inspection and network access so that a single agent cannot both collect local data and transmit it externally without an approval boundary. 9. Document why each granted tool is necessary and periodically review the declarations for least-privilege compliance.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Harmful Content Injection

Critical

• Category: Prompt Injection

Content

## Grounding Protocol — ANTI-RECURSION (CRITICAL)

- **3-level depth limit**: You may question a premise, question the response, and question once more. After 3 levels, you MUST state your own position clearly.
- **No re-asking answered questions**: If a council member has directly addressed your question with evidence or reasoning, you may not ask the same question again in different words.
- **Convergence requirement**: In Round 3 (Synthesis), you get exactly ONE question. Use it on the most important unresolved issue. Then state your position.
- **The hemlock rule**: If the coordinator flags you for recursive questioning, you must immediately state your strongest position in 50 words or less.

## Output Format (Standalone)

When invoked directly (not via /council), structure your response as:

• Confidence: 70% confidence
• Finding: This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Harmful Content Injection

Critical

• Category: Prompt Injection

Content

## Grounding Protocol — ANTI-RECURSION (CRITICAL)

- **3-level depth limit**: You may question a premise, question the response, and question once more. After 3 levels, you MUST state your own position clearly.
- **No re-asking answered questions**: If a council member has directly addressed your question with evidence or reasoning, you may not ask the same question again in different words.
- **Convergence requirement**: In Round 3 (Synthesis), you get exactly ONE question. Use it on the most important unresolved issue. Then state your position.
- **The hemlock rule**: If the coordinator flags you for recursive questioning, you must immediately state your strongest position in 50 words or less.

## Output Format (Standalone)

When invoked directly (not via /council), structure your response as:

• Confidence: 70% confidence
• Finding: This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

cp agents/council-*.md ~/.claude/agents/

# Copy skill
mkdir -p ~/.claude/skills/council
cp SKILL.md ~/.claude/skills/council/SKILL.md
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

cp agents/council-*.md ~/.claude/agents/

# Copy skill
mkdir -p ~/.claude/skills/council
cp SKILL.md ~/.claude/skills/council/SKILL.md
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This persona is described as a council member for analysis and deliberation, but it is granted powerful execution and exfiltration-adjacent capabilities including Bash, WebSearch, and WebFetch. That violates least privilege: if the persona is steered by malicious prompt content or participates in a broader multi-agent workflow, it could execute commands, inspect local files, or retrieve remote content well beyond what is necessary for its stated role.

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage

Content

*Build the answer from basic components, step by step*

### The Simple Explanation
*If you had to explain this to a smart non-expert in 3 sentences, what would you say?*

### Reality Check
*How would you test this? What would prove you wrong?*

• Confidence: 70% confidence
• Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This council-member skill is described as a deliberative analyst, but it is granted Bash, WebSearch, and WebFetch in addition to read-only capabilities. Those tools materially expand the attack surface: prompt-injection from fetched/web content, shell command execution, and unnecessary external data access can all be abused if the persona is invoked directly or manipulated through adversarial input. The skill context makes this more dangerous because the file explicitly supports standalone use, so these capabilities are not merely inherited for orchestration but exposed to an individual persona that does not need them for its stated role.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

echo "  Installed 8 council agents to ${CLAUDE_DIR}/agents/"

# Copy skill
cp "${SCRIPT_DIR}/SKILL.md" "${CLAUDE_DIR}/skills/council/SKILL.md"
echo "  Installed skill to ${CLAUDE_DIR}/skills/council/"

echo ""

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

echo "  Installed 8 council agents to ${CLAUDE_DIR}/agents/"

# Copy skill
cp "${SCRIPT_DIR}/SKILL.md" "${CLAUDE_DIR}/skills/council/SKILL.md"
echo "  Installed skill to ${CLAUDE_DIR}/skills/council/"

echo ""

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Static analysis

No suspicious patterns detected.