subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes implementation plans, task briefs, and code diffs which are interpolated into subagent prompts (e.g., in
implementer-prompt.mdandtask-reviewer-prompt.md). There are no sanitization steps or explicit boundary markers to prevent malicious instructions embedded in these files from being executed by the subagents. - Ingestion points: The skill reads implementation plan files (
PLAN_FILE), task brief files, and git diffs which are passed to subagents. - Boundary markers: The prompt templates for subagents (
code-reviewer.md,implementer-prompt.md,task-reviewer-prompt.md) lack clear delimiters or instructions to ignore embedded commands within the ingested content. - Capability inventory: The system allows for file creation, script execution, and git operations. The implementer subagent is explicitly granted the capability to modify the codebase and commit changes.
- Sanitization: The skill does not perform any escaping or filtering of the content extracted from plan files or diffs before passing it to subagents.
Audit Metadata