Sharedintellect Quorum

Multi-agent validation framework — 6 independent AI critics evaluate artifacts against rubrics with evidence-grounded findings.

Summary of what to check and how to reduce risk before installing or running this skill: 1) Audit the repo and dependencies first: do a manual git clone and inspect requirements.txt, CLI entry points, and any setup/install scripts before running pip install. Consider installing into an isolated virtualenv or disposable container/VM. 2) Review prompts and agent templates: the package includes many prompt files; search for phrases like 'ignore previous' or 'system prompt' and confirm they are used only internally and not sent to models in ways that would elevate privileges or leak secrets. 3) Limit API key exposure: provide only the provider key(s) you intend to use (Anthropic or OpenAI), and use scoped/ephemeral keys where possible. Treat these keys as sensitive — the tool will send artifact contents to those model endpoints. 4) Control automatic edits: the Fixer component can apply proposed fixes. Before running, check configuration options (or run in a 'dry-run' / --no-fixer mode) so the tool does not modify source files without explicit approval. 5) Sandbox runs when validating sensitive artifacts: the tool will run local linters, may invoke shell commands, and will call LLM APIs (network traffic). Run the tool on non-sensitive examples first and consider network-restricted testing for artifacts containing secrets. 6) Inspect prescreen/outputs: Quorum writes prescreen.json, verdict.json, report.md, and known_issues.json — review these outputs for unexpected data collection. Remove or redact secrets from artifacts before validation. 7) If you need stronger assurance: ask the maintainer for a signed release (PyPI release or GitHub release tag), or prefer installing the published PyPI package (quorum-validator) rather than cloning main, after verifying release provenance. If you want, I can: (a) point out specific files that mention automatic 'apply' behavior, (b) fetch and summarize requirements.txt for further scrutiny, or (c) list the prompt/template files that contain the prompt-injection patterns so you can inspect them.

Type: OpenClaw Skill Name: quorum Version: 0.7.3 The Quorum skill bundle is a comprehensive multi-agent validation framework designed to evaluate code, configurations, and research artifacts against structured rubrics. The implementation is highly professional, featuring a deterministic pre-screen layer (prescreen.py) that uses regex and integrated SAST tools (Ruff, Bandit, DevSkim) to catch common errors, and a multi-phase LLM pipeline (pipeline.py) for semantic analysis. The security critic is grounded in industry standards like OWASP ASVS and CWE. While the tool requires API keys and has broad file-read capabilities, these are strictly aligned with its stated purpose of quality assurance. No evidence of malicious intent, data exfiltration, or adversarial prompt injection was found.