subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from implementation plans and interpolates it directly into subagent prompts.
- Ingestion points: Implementation plan files (e.g.,
docs/plans/*.md) are read and parsed to extract task descriptions. - Boundary markers: The prompt templates in
implementer-prompt.mdandspec-reviewer-prompt.mdinterpolate the full text of tasks without using specific delimiters or 'ignore embedded instructions' warnings to prevent the subagent from following instructions hidden within the plan. - Capability inventory: The implementer subagent is granted capabilities to modify the filesystem, perform git commits, and execute tests as defined in its Job description.
- Sanitization: There is no evidence of sanitization, validation, or escaping of the external plan content before it is provided to the subagents.
Audit Metadata