subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates a workflow where subagents ingest and process implementation plans, developer reports, and source code, which are potential vectors for indirect prompt injection.
- Ingestion points: The
implementer-prompt.mdtemplate ingests task descriptions from external plans, whilespec-reviewer-prompt.mdingests requirements, implementer reports, and implementation code. - Boundary markers: The templates use Markdown headers (e.g.,
## Task Description) to delimit injected content, but lack explicit sanitization or escaping mechanisms for the raw text. - Capability inventory: Subagents are instructed to perform file modifications, Git commits, and test execution using general-purpose tools.
- Sanitization: While no technical sanitization is present, the skill includes defensive instructions, specifically requiring the spec reviewer subagent to 'not trust the report' and verify all claims by reading the actual code.
Audit Metadata