create-subagent
Warn
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses variables obtained from an interactive Node.js script directly in shell commands including mkdir -p and ln -s. Evidence: Step 4 in SKILL.md uses and variables in a bash block.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from a script that accepts arbitrary user input without validation for shell metacharacters or path traversal. Ingestion points: scripts/gather-subagent-info.cjs collects input via readline.question. Boundary markers: None present to distinguish data from instructions. Capability inventory: Shell execution (bash), file system creation (mkdir), and symlinking (ln -s). Sanitization: The script only uses .trim() and .split(), failing to filter for characters like .. , / , ; , or & .
Audit Metadata