subagent-driven-development

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill's core architecture involves a multi-agent pipeline where the implementer subagent's output is used as input for two subsequent reviewer subagents, creating a surface for indirect prompt injection or instruction poisoning.
  • Ingestion points: The spec-reviewer-prompt.md and code-quality-reviewer-prompt.md templates interpolate data from the implementer's report and the implementation code directly into their prompts.
  • Boundary markers: The skill includes strong negative constraints in spec-reviewer-prompt.md ('CRITICAL: Do Not Trust the Report', 'The implementer finished suspiciously quickly', 'verify everything independently') designed to prevent the reviewer from being manipulated by the implementer's output.
  • Capability inventory: Subagents are granted capabilities to modify files, perform git commits, and execute tests within the project directory.
  • Sanitization: The skill relies on natural language instructions for validation rather than structured schema enforcement or programmatic sanitization when passing data between subagents.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 06:55 AM
Security Audit — agent-trust-hub — subagent-driven-development