Scan Report
5 /100
council-v2
Multi-model council review skill that dispatches 3-5 independent AI reviewers and applies mechanical synthesis
This is a legitimate multi-model code review orchestration skill with transparent, documented behavior and no malicious indicators.
Safe to install
This skill is safe to use. No security concerns identified.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | READ | READ | ✓ Aligned | SKILL.md states 'Reads content from file or stdin' |
| Shell | WRITE | WRITE | ✓ Aligned | SKILL.md declares bash script execution for council.sh and synthesize.py |
| Network | NONE | NONE | — | No network calls found in scripts; external URLs in README are documentation onl… |
| Environment | NONE | NONE | — | No environment variable access observed |
| Skill Invoke | WRITE | WRITE | ✓ Aligned | SKILL.md explicitly states 'spawns 3-5 independent AI reviewers' |
4 findings
Medium External URL 外部 URL
https://openrouter.ai README.md:43 Medium External URL 外部 URL
https://openrouter.ai/api/v1 README.md:48 Medium External URL 外部 URL
https://docs.openclaw.ai/concepts/models README.md:57 Medium External URL 外部 URL
http://json-schema.org/draft-07/schema# references/schema.md:7 File Tree
10 files · 35.0 KB · 1152 lines Markdown 7f · 780L
Python 1f · 202L
Shell 2f · 170L
├─
▾
assets
│ └─
council-v2-banner.md
Markdown
├─
▾
references
│ ├─
review-types.md
Markdown
│ ├─
role-prompts.md
Markdown
│ ├─
schema.md
Markdown
│ └─
synthesis-rules.md
Markdown
├─
▾
scripts
│ ├─
council.sh
Shell
│ ├─
retro.sh
Shell
│ └─
synthesize.py
Python
├─
README.md
Markdown
└─
SKILL.md
Markdown
Security Positives
✓ Comprehensive SKILL.md with clear behavior documentation
✓ No credential harvesting or sensitive data access
✓ No obfuscation techniques (base64, eval, etc.)
✓ No remote script execution patterns (curl|bash, wget|sh)
✓ Clean subprocess usage limited to documented orchestration tasks
✓ JSON validation in synthesize.py prevents malformed input exploits
✓ No supply chain risks - Python stdlib only, no external dependencies
✓ Set -euo pipefail in bash scripts prevents silent failures
✓ No hidden functionality - all behavior matches documentation