subagent-orchestration
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and execute user-provided multi-phase plans autonomously without further intervention once approved. These plans drive subagents that possess the capability to write files and execute shell commands (e.g.,
npm build,tsc,cargo check). A malicious plan could potentially embed instructions that exploit this autonomy. - Ingestion points: The workflow relies on a detailed plan document defined by the user (referencing
references/plan-template.md). - Boundary markers: The skill employs strict role separation between implementers and validators and a 'NO-SLOP' policy to maintain quality, though it does not explicitly instruct the agent to disregard instructions or control codes embedded within the plan requirements.
- Capability inventory: The orchestrator dispatches subagents which are authorized to perform file system modifications and execute various shell-based build and validation tools across multiple phases (
SKILL.md,references/subagent-templates.md). - Sanitization: Requirement text from the plan is interpolated directly into subagent dispatch messages without sanitization or escaping mechanisms.
Audit Metadata