subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from implementation plans and interpolates it directly into the context of subagents.
- Ingestion points: Task text is extracted in SKILL.md and passed to implementer-prompt.md ([FULL TEXT of task]) and spec-reviewer-prompt.md ([FULL TEXT of task requirements]).
- Boundary markers: The skill uses markdown headers (e.g., '## Task Description') as boundaries, but lacks explicit sanitization or instructions for the subagent to ignore potentially malicious embedded commands within that content.
- Capability inventory: Subagents are authorized to modify files, write tests, and commit code based on the instructions provided in the untrusted task text.
- Sanitization: No sanitization, escaping, or strict schema validation of the input task text was detected.
Audit Metadata