subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes several bash scripts (
scripts/review-package,scripts/sdd-workspace,scripts/task-brief) used to manage the development workflow. - These scripts execute local commands including
git(log, diff, rev-parse, rev-list),awk,mkdir, and standard file operations. - The
SKILL.mdinstructions also encourage the agent to use shell redirection (cat >> progress.md <<'EOF') instead of standard platform editing tools to manage its progress ledger. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest external implementation plans and process them using subagents, which introduces an indirect prompt injection surface.
- Ingestion points: The
PLAN_FILEand any referenced specification files are read by the controller agent and extracted by thescripts/task-briefscript. - Boundary markers: The prompt templates for subagents (
implementer-prompt.md,task-reviewer-prompt.md) use markdown headers (e.g.,## Task Description) to isolate injected plan content, but they do not provide explicit instructions for the subagent to ignore potentially malicious directions within that content. - Capability inventory: The skill allows for local file system writes,
gitrepository modifications, and the ability to dispatch further subagents with arbitrary prompts. - Sanitization: No sanitization, escaping, or validation is performed on the plan content before it is interpolated into the prompts for the subagents.
- [DYNAMIC_EXECUTION]: The skill dynamically generates execution contexts for subagents by populating markdown templates with data extracted from plan files and git history.
- It utilizes
scripts/review-packageto generate a diff file which is then read in a single call by the reviewer subagent to provide context for its analysis.
Audit Metadata