subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external implementation plans (e.g., docs/plans/feature-plan.md) and task descriptions, which are considered untrusted data sources.
- Ingestion points: External task text and plan details are extracted by the controller and interpolated into the prompts for subagents in
implementer-prompt.mdandspec-reviewer-prompt.md. - Boundary markers: The prompt templates lack explicit delimiters (such as XML tags or unique markers) to isolate the untrusted task content from the subagent instructions. There are no explicit instructions for the subagent to ignore commands or jailbreak attempts embedded within the task descriptions.
- Capability inventory: Subagents are expected to have file-writing, testing, and git-commit capabilities within the workspace to complete the implementation tasks.
- Sanitization: The skill performs no escaping, filtering, or validation of the plan file content before it is processed by the subagents, allowing potential instructions inside a plan to influence the subagent's execution environment.
Audit Metadata