Skip to content
skillsafebeta
← Report library
Purpose / Other

Council Skill Security Audit

What the author says it does (original text)

Run a model-diverse subagent council to investigate the same problem from multiple perspectives, compare findings, and produce a final recommendation. Use this skill whenever the user asks for a council, second opinions, multiple agents/models to evaluate one question, parallel investigation, red-team/blue-team comparison, or help deciding between competing technical approaches.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Repository and design context may be sent to multiple model providers

Source references: 5
What we found

The Skill prioritizes different model families and directs the shared brief to include repository paths, background, and relevant files or symbols. Some candidate models may be hosted by different remote providers, so the same code or design context can be processed by several services.

Why this matters

If prompts contain private source code, unreleased designs, customer data, or credentials, those materials could enter multiple providers’ processing or logging boundaries, increasing exposure.

The Skill prioritizes different model families and puts repository/artifact locations, background, and relevant files or symbols into the shared brief. If the selected agents are hosted by different remote services, the same project context could therefore be processed by multiple providers. The source does not establish that the models are remote or that any transfer occurred. A user can require approved/local models and restrict code, paths, and sensitive design details in the brief.

SKILL.md:29In the instructionsOpen original file
Preferred default roster for a three-member council:- Opus 4.7 or the strongest available Claude/Opus reasoning model: architecture, correctness, and edge-case analysis.- GPT 5.5 or the strongest available GPT/Codex model: implementation-grounded review, feasibility, and test strategy.- An open-source model such as Kimi 2.6, GLM 5.1, or the strongest available OSS/local model: contrarian critique, hidden assumptions, and alternative framing.If one of these exact models is unavailable in the active harness, use the closest available model from that family and note the substitution. If no open-source model is available, use a third distinct frontier model if possible; otherwise use the strongest remaining model with a deliberately adversarial or specialist angle.
Show 4 other places
SKILL.md:54In the instructionsOpen original file
The shared brief should include:- repository path or artifact location;- current branch or base context;- the exact question to answer;- relevant background and known concerns;- required files/symbols to inspect, if known;- constraints, especially read-only/no commits/no PRs;- expected report format.
SKILL.md:52In the instructionsOpen original file
For explicit orchestration requests, briefly tell the user which council members you plan to launch and what each will investigate, then wait for approval before calling `run_agents`.
SKILL.md:27In the instructionsOpen original file
Prioritize model diversity. A council should not default to three agents on the same model with different angles; use that only when the available launch configuration cannot provide multiple useful models, or when the user explicitly asks for one model. If model diversity is unavailable, say so briefly before falling back to perspective-only diversity.
SKILL.md:31In the instructionsOpen original file
- Opus 4.7 or the strongest available Claude/Opus reasoning model: architecture, correctness, and edge-case analysis.- GPT 5.5 or the strongest available GPT/Codex model: implementation-grounded review, feasibility, and test strategy.- An open-source model such as Kimi 2.6, GLM 5.1, or the strongest available OSS/local model: contrarian critique, hidden assumptions, and alternative framing.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

A routine “second opinion” request may trigger several billable model calls

Source references: 4
What we found

The Skill triggers for second opinions and technical-option decisions, defaults to three council members, and requires separate run_agents calls for different models. Pre-launch approval is explicitly required only for “explicit orchestration requests.”

Why this matters

On usage-priced accounts, the user could incur several model charges and consume concurrency or quota without first seeing the roster, model choices, or budget.

What this evidence establishes

The source supports triggering the Skill for a “second opinion,” using three members by default, and potentially making separate launches for different models. It explicitly requires prior approval only for “explicit orchestration requests.” This can increase usage or quota consumption, but the source provides no pricing, billing-account, or paid-model information, so paid charges cannot be confirmed. A user can require the member count, models, expected calls, and estimated cost to be shown and approved before every multi-agent launch.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:3In the instructionsOpen original file
name: councildescription: Run a model-diverse subagent council to investigate the same problem from multiple perspectives, compare findings, and produce a final recommendation. Use this skill whenever the user asks for a council, second opinions, multiple agents/models to evaluate one question, parallel investigation, red-team/blue-team comparison, or help deciding between competing technical approaches.---
Show 3 other places
SKILL.md:29In the instructionsOpen original file
Preferred default roster for a three-member council:- Opus 4.7 or the strongest available Claude/Opus reasoning model: architecture, correctness, and edge-case analysis.- GPT 5.5 or the strongest available GPT/Codex model: implementation-grounded review, feasibility, and test strategy.- An open-source model such as Kimi 2.6, GLM 5.1, or the strongest available OSS/local model: contrarian critique, hidden assumptions, and alternative framing.
SKILL.md:44In the instructionsOpen original file
When different children need different models, launch them in separate `run_agents` calls because model selection is run-wide. If the requested model resolves differently than expected, treat the resolved launch settings as authoritative and continue unless they make the task infeasible.
SKILL.md:52In the instructionsOpen original file
For explicit orchestration requests, briefly tell the user which council members you plan to launch and what each will investigate, then wait for approval before calling `run_agents`.

Inside this skill

3 instruction sections

The Skill has multiple child agents investigate the same question independently, then asks the parent agent to synthesize a recommendation based on evidence quality rather than vote count.

View source
SKILL.md:8In the instructionsOpen original file
Use this skill to coordinate multiple subagents investigating the same question, with different models first and different assigned perspectives second, then synthesize their reports into one recommendation.This skill is best for judgment-heavy tasks: architecture tradeoffs, risky bug fixes, code review red-teaming, rollout decisions, incident analysis, and “is this alternative worth pursuing?” questions.
SKILL.md:88In the instructionsOpen original file
Compare the reports by evidence quality, not by vote count. In the final answer:- lead with the recommendation;- call out consensus and disagreements;- explain why the recommended option wins against the decision criteria;- explicitly address the user’s stated concern;- include relevant file paths/symbols without overloading the answer;- distinguish “do now” from optional future hardening;- mention confidence and material unknowns.

The default council uses three different model families and assigns each member a different review angle; the Skill selects substitute models when preferred models are unavailable.

View source
SKILL.md:29In the instructionsOpen original file
Preferred default roster for a three-member council:- Opus 4.7 or the strongest available Claude/Opus reasoning model: architecture, correctness, and edge-case analysis.- GPT 5.5 or the strongest available GPT/Codex model: implementation-grounded review, feasibility, and test strategy.- An open-source model such as Kimi 2.6, GLM 5.1, or the strongest available OSS/local model: contrarian critique, hidden assumptions, and alternative framing.If one of these exact models is unavailable in the active harness, use the closest available model from that family and note the substitution. If no open-source model is available, use a third distinct frontier model if possible; otherwise use the strongest remaining model with a deliberately adversarial or specialist angle.

Read-only investigations share one checkout, while implementation or prototyping councils require a separate Git worktree and branch for each local child agent.

View source
SKILL.md:48In the instructionsOpen original file
For read-only investigations, keep all children in the same checkout and explicitly tell them not to edit files. For implementation or prototyping councils, give each local child its own git worktree and branch so they cannot collide.
SKILL.md:127In the instructionsOpen original file
- If the council is read-only, tell children not to modify files, commit, create branches, or open PRs.- If the council involves PR or branch work, follow the repository’s normal version-control rules and use isolated worktrees for parallel local edits.- If the council is about code review feedback, mark review comments resolved only after the underlying issue is actually addressed.- Do not expose internal child agent IDs in user-facing summaries unless the user explicitly asks for them.

Pre-launch user approval is explicitly required only for “explicit orchestration requests”; the text does not impose the same per-launch approval requirement for other triggers.

View source
SKILL.md:3In the instructionsOpen original file
name: councildescription: Run a model-diverse subagent council to investigate the same problem from multiple perspectives, compare findings, and produce a final recommendation. Use this skill whenever the user asks for a council, second opinions, multiple agents/models to evaluate one question, parallel investigation, red-team/blue-team comparison, or help deciding between competing technical approaches.---
SKILL.md:52In the instructionsOpen original file
For explicit orchestration requests, briefly tell the user which council members you plan to launch and what each will investigate, then wait for approval before calling `run_agents`.
Start here · InstructionsSKILL.md
council
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
131
File checksum (to compare versions)
52b92bd892f98cf0de07a88ce880dc99c59d633b7253ecd3ac90c4fea1a0f799