sub-agent-sandboxing
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the orchestrator to use standard Git commands (
git diff,git stash) to verify that reviewer sub-agents have not modified the working tree. These are benign diagnostic commands used for validation purposes. - [DATA_EXFILTRATION]: No evidence of data exfiltration detected. The skill explicitly includes a validation step to check for 'secrets or credential leaks in logs' before accepting output from a sub-agent, which is a security-positive practice.
- [INDIRECT_PROMPT_INJECTION]: The skill addresses the attack surface where an orchestrator processes output from untrusted sub-agents. It mitigates this risk by recommending explicit read-only constraints in briefs, using boundary markers, and requiring manual validation of touched files and dependency changes before merging output.
- [PROMPT_INJECTION]: The skill does not contain instructions to bypass safety filters or override system prompts. Instead, it provides templates for 'reviewer briefs' that enforce restrictive behavior (e.g., 'You are a reviewer... Do not edit, create, or delete any files').
- [REMOTE_CODE_EXECUTION]: While the skill mentions using Docker or Kubernetes for 'Sandbox Escalation,' it does so as a security measure to isolate potentially risky delegated tasks. It does not provide or download any external malicious payloads or scripts.
Audit Metadata