subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill utilizes implementation plans and task descriptions as input for subagents, creating a surface for indirect prompt injection.
- Ingestion points: Plan files (such as
feature-plan.md) and task metadata are read inSKILL.mdand their contents are interpolated into the prompts for implementer and reviewer subagents. - Boundary markers: The skill recommends using
json:metadatacode fences for task metadata, which provides a structural delimiter between data and prose, though this does not fully prevent instruction leakage. - Capability inventory: Subagents are dispatched with
general-purposetools and other development skills (e.g.,using-git-worktrees), which include capabilities for file system modification and command execution. - Sanitization: No explicit sanitization, filtering, or instruction-override protection is described for the external content before it is processed by the subagents.
Audit Metadata