team
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to the way it handles external data and local file contents during sub-agent initialization.
- Ingestion points: The skill ingests untrusted user input via the
$ARGUMENTSplaceholder and reads role definitions from the.claude/agents/directory. - Boundary markers: The instructions lack requirements for using protective delimiters (like XML tags or triple quotes) or 'ignore embedded instructions' warnings when interpolating these values into prompts.
- Capability inventory: The skill utilizes agent creation and task spawning tools, meaning injected instructions could potentially influence the behavior of multiple sub-agents and the creation of output files in the
docs/directory. - Sanitization: There is no evidence of content filtering, validation, or escaping of the ingested text before it is used to define sub-agent roles.
Audit Metadata