subagent-driven-development

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill instructs autonomous, continuous execution of plan tasks by dispatching fresh subagents and explicitly discourages checking in with the human partner between tasks, which is suspicious steering without clear malicious intent.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow only reads the user-provided plan text (e.g., “Read plan file once” / “FULL TEXT of task from plan”) and then passes that extracted task text into subagent prompts; it does not include any runtime ingestion of outsider-authored external feeds, tickets, email, GitHub issues/PRs, or other monitored sources.