subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill consumes external implementation plans and injects their contents into prompts for subagents, creating a vulnerability surface where malicious instructions in a plan file could influence subagent behavior.
- Ingestion points: Task descriptions and requirements are extracted in
SKILL.mdand interpolated into the prompt templatesimplementer-prompt.mdandspec-reviewer-prompt.md. - Boundary markers: The templates use Markdown headers (e.g.,
## Task Description) to delimit injected content, which provides only weak isolation against instructions designed to mimic the prompt structure. - Capability inventory: As defined in
implementer-prompt.md, the implementer subagent is granted capabilities to modify the codebase, execute tests, and commit changes, providing a high-impact surface for injected instructions to exploit. - Sanitization: The skill does not perform any explicit sanitization, filtering, or validation of the plan content before passing it to subagents.
Audit Metadata