subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes implementation plans, which serve as an external data source. This presents a surface for indirect prompt injection if a plan contains malicious instructions intended to manipulate subagent behavior.
- Ingestion points: External implementation plans provided to subagents as documented in
SKILL.mdandimplementer-prompt.md. - Boundary markers: Requirements are wrapped in specific markdown sections within subagent prompts to separate instructions from data.
- Capability inventory: Subagents are authorized to modify files, run tests, and manage git commits.
- Sanitization: The skill does not perform automated sanitization of plan content.
- Mitigation: The workflow mitigates this risk through a mandatory two-stage review process (specification compliance and code quality). Reviewer agents are explicitly instructed in
spec-reviewer-prompt.mdto verify changes by reading actual code instead of relying on the implementer's report.
Audit Metadata