code-subagents
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates a workflow where the output of 'implementer' agents is passed into the prompt context of 'reviewer' agents.
- Ingestion points: The template
references/batch-reviewer-prompt.mdinterpolates{BATCH_PATCHES}and{IMPLEMENTER_REPORTS}, whilereferences/implementor-prompt.mdinterpolates{WORK_ITEM_REQUIREMENTS}. - Boundary markers: While the templates use Markdown headers (e.g.,
## Task Patches), they lack robust delimiters or specific instructions for the agent to treat the interpolated data as potentially untrusted content. - Capability inventory: Implementer subagents are given file system write access and the ability to execute tests. Reviewer subagents analyze these results. A compromised or malicious subagent could embed instructions in its report or code comments to bypass reviewer scrutiny.
- Sanitization: The skill does not define any sanitization or validation of subagent outputs before they are processed by the coordinator or reviewers.
Audit Metadata