subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it executes tasks defined in external plan files without sanitization or explicit isolation instructions for the subagents.
- Ingestion points: Implementation plans (e.g.,
docs/plans/feature-plan.md) are read by the controller and the full text of tasks is passed to theimplementer-prompt.mdandspec-reviewer-prompt.mdtemplates. - Boundary markers: While the prompt templates use Markdown headers to structure the task description and context, they do not include explicit delimiters or warnings to the subagent to ignore or treat embedded instructions as inert data.
- Capability inventory: The implementer subagent is granted tool access for implementing code, writing tests, and executing them, which typically involves file system and shell access.
- Sanitization: There is no evidence of sanitization, validation, or filtering of the content extracted from the plan files before it is interpolated into the subagent prompts.
Audit Metadata