Subagent-Driven Development
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by interpolating untrusted data from external plan files into the instructions provided to subagents.
- Ingestion points: The agent reads a 'plan file' in Step 1 and 'Task N' details from that plan in Step 2 and Step 3.
- Boundary markers: The instructions do not define explicit boundary markers or delimiters (e.g., XML tags or specific 'ignore' warnings) to isolate the task content from the subagent's system-level instructions.
- Capability inventory: Subagents are granted capabilities to implement code, write and run tests, and commit changes to the repository via git.
- Sanitization: There is no mention of sanitization, validation, or filtering of the content read from the plan file before it is interpolated into the implementation or reviewer subagent prompts.
Audit Metadata