coordinating-agent-teams
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to incorporate untrusted external text—such as Linear ticket descriptions, pull request bodies, or fetched web content—into the spawn prompts of subagents, creating a surface for indirect prompt injection.\n
- Ingestion points: These are documented in
SKILL.mdunder the 'External text in spawn prompts' section.\n - Boundary markers: The skill explicitly mandates the use of delimited tags with unique random IDs (e.g.,
<pasted_content id="k7q2">) to isolate external content from the agent's instructions.\n - Capability inventory: The subagents coordinated by this framework (such as
backend-devorbranch-rebaser) are capable of modifying files and executing shell commands.\n - Sanitization: Recommended mitigations include passing content references (IDs) instead of raw text, and using agent-generated summaries to strip potential instructions while retaining facts.
Audit Metadata