subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Potential for Indirect Prompt Injection through untrusted data ingestion.
- Ingestion points: The skill reads a plan file in the setup phase (Step 0) to extract all tasks for execution.
- Boundary markers: There are no defined delimiters or specific instructions for the agent to treat the plan content as untrusted data or to ignore embedded instructions.
- Capability inventory: The process involves dispatching subagents with the ability to modify the codebase, run tests, and perform git commits across multiple files.
- Sanitization: The instructions do not include any steps for validating or sanitizing the content of the plan file before processing.
- [PROMPT_INJECTION]: High-autonomy workflow instructions reduce human oversight. The directive to perform 'Continuous execution' and 'not pause to check in between tasks' increases the risk that instructions embedded in a plan file could be executed without the user having an opportunity to review the subagent's proposed actions.
Audit Metadata