subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core architecture involves a multi-agent pipeline where the implementer subagent's output is used as input for two subsequent reviewer subagents, creating a surface for indirect prompt injection or instruction poisoning.
- Ingestion points: The
spec-reviewer-prompt.mdandcode-quality-reviewer-prompt.mdtemplates interpolate data from the implementer's report and the implementation code directly into their prompts. - Boundary markers: The skill includes strong negative constraints in
spec-reviewer-prompt.md('CRITICAL: Do Not Trust the Report', 'The implementer finished suspiciously quickly', 'verify everything independently') designed to prevent the reviewer from being manipulated by the implementer's output. - Capability inventory: Subagents are granted capabilities to modify files, perform git commits, and execute tests within the project directory.
- Sanitization: The skill relies on natural language instructions for validation rather than structured schema enforcement or programmatic sanitization when passing data between subagents.
Audit Metadata