subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a workflow that dispatches subagents to perform tasks based on implementation plans, creating a surface where instructions within the plans could influence agent behavior.\n
- Ingestion points: Implementation plan files (e.g.,
conductor/tracks/{track_id}/plan.md) are read, and the full text of extracted tasks is pasted into the prompts for implementer and reviewer subagents.\n - Boundary markers: The prompt templates use Markdown headers (e.g.,
## Task Description) to separate external data, but they lack high-entropy delimiters or explicit instructions for the subagents to ignore potentially malicious commands embedded within the task text.\n - Capability inventory: Subagents orchestrated by this skill have access to sensitive tools, including file system operations (
read_file,write_file), version control (git), and generic tool execution through a general-purpose task runner.\n - Sanitization: There is no evidence of sanitization or validation performed on the ingested plan content before it is interpolated into the agent context.
Audit Metadata