subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted implementation plans and interpolates task descriptions directly into subagent prompts.\n
- Ingestion points: Implementation plans (e.g., docs/plans/feature-plan.md) are read in SKILL.md and used to generate subagent prompts.\n
- Boundary markers: The skill does not employ delimiters or explicit instructions to ignore embedded commands when interpolating task text into implementer-prompt.md or spec-reviewer-prompt.md.\n
- Capability inventory: Subagents are granted the capability to modify the filesystem via TodoWrite, implement and execute code/tests, and perform git operations.\n
- Sanitization: No validation or sanitization is performed on the task content prior to injection into subagent context.\n- [COMMAND_EXECUTION]: The workflow directs subagents to implement features and run tests based on external task specifications. This provides an execution path for code that could be generated based on malicious input requirements.
Audit Metadata