dispatching-agent-teams
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user's project filesystem as its primary source of instructions.
- Ingestion points: Reads team definition files from
teams/{name}.mdat the project root andskills/tools/agent-teams/teams/{name}.md. - Boundary markers: The skill lacks explicit boundary markers or 'ignore embedded instructions' warnings when parsing the YAML frontmatter or Markdown body of these team files.
- Capability inventory: The skill has the ability to spawn new agent teams (using
TeamCreateor delegation tools), preload external skills, and manage shared task lists. It also generates 'differential briefs' for sub-agents by interpolating content directly from the team files. - Sanitization: There is no evidence of sanitization, escaping, or validation of the instructions contained within the team files before they are used to drive agent behavior.
- Contract Enforcement: The skill's 'Core Principles' explicitly mandate that the 'Team file is the contract' and that the agent should 'not improvise the process,' which increases the risk that malicious or hijacked instructions in a team file will be followed without deviation.
Audit Metadata