sub-agent-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill metadata contains conflicting author information. While the provided author is 'ma1orek', the 'plugin.json' file identifies the author as 'Jeremy Dawes' with an email address 'jeremy@jezweb.net'. This inconsistency in identity metadata can be misleading.
- [INDIRECT_PROMPT_INJECTION]: The skill documentation and rules promote a 'Research and Fix' pattern that creates a vulnerability surface for indirect prompt injection.
- Ingestion points: The prompt templates in 'SKILL.md' and 'rules/sub-agent-patterns.md' explicitly instruct agents to use 'WebFetch', 'WebSearch', and 'Read' to ingest data from external sources and project files.
- Boundary markers: The provided templates lack delimiters or instructions to ignore embedded commands within the fetched external data.
- Capability inventory: The templates grant the agent the authority to 'FIX issues found', involving tools such as 'Write', 'Edit', and 'Bash' to modify the local environment based on external input.
- Sanitization: No sanitization or validation logic is proposed for the content retrieved from external URLs before it is used to influence file modifications.
Audit Metadata