subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external implementation plans, which represents a vulnerability surface for indirect prompt injection. A malicious plan could contain instructions designed to manipulate the subagents into performing unauthorized actions.
- Ingestion Point: SKILL.md instructs the agent to read plan files and extract task descriptions.
- Capability Inventory: Subagents are granted capabilities to modify the filesystem, write code, run tests, and perform git commits via the implementer-prompt.md template.
- Boundary Markers: The prompt templates lack explicit instructions to disregard potential commands embedded within the untrusted task text.
- Sanitization: The skill does not perform sanitization or validation of the plan data before processing.
- [COMMAND_EXECUTION]: The workflow involves subagents executing shell commands for code implementation, testing, and git operations.
- [PROMPT_INJECTION]: The skill instructions include directives to "Execute all tasks from the plan without stopping" and "Do not pause to check in with your human partner," which removes human-in-the-loop verification checkpoints and increases the impact of potentially malicious inputs.
Audit Metadata