subagent-driven-development

Pass

Audited by Gen Agent Trust Hub on May 16, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill utilizes implementation plans and task descriptions as input for subagents, creating a surface for indirect prompt injection.
  • Ingestion points: Plan files (such as feature-plan.md) and task metadata are read in SKILL.md and their contents are interpolated into the prompts for implementer and reviewer subagents.
  • Boundary markers: The skill recommends using json:metadata code fences for task metadata, which provides a structural delimiter between data and prose, though this does not fully prevent instruction leakage.
  • Capability inventory: Subagents are dispatched with general-purpose tools and other development skills (e.g., using-git-worktrees), which include capabilities for file system modification and command execution.
  • Sanitization: No explicit sanitization, filtering, or instruction-override protection is described for the external content before it is processed by the subagents.
Audit Metadata
Risk Level
SAFE
Analyzed
May 16, 2026, 03:46 PM
Security Audit — agent-trust-hub — subagent-driven-development