subagent-teams
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATIONCREDENTIALS_UNSAFECOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill orchestration pattern relies on subagents reading codebase files, which exposes the agent to indirect prompt injection from untrusted repository content. Ingestion points: Explore and general-purpose subagents use Glob, Grep, and Read tools on the codebase as specified in SKILL.md. Boundary markers: Absent in prompt templates found in reference/prompt-templates.md. Capability inventory: general-purpose subagents have access to Bash and Write tools as detailed in reference/task-tool-guide.md. Sanitization: Absent.
- [PRIVILEGE_ESCALATION]: The skill instructions in SKILL.md document the 'dontAsk' permission mode, which bypasses human-in-the-loop approval for all tool executions, potentially leading to unvetted shell commands and file modifications.
- [CREDENTIALS_UNSAFE]: SKILL.md documents the storage of 'machine-specific paths or credentials' within the 'local' memory scope located at ~/.claude/local/agent-memory/, highlighting a sensitive data location to the agent.
- [COMMAND_EXECUTION]: The orchestration patterns for 'general-purpose' subagents include instructions to utilize shell tools (Bash) for implementation and quality checks.
- [PERSISTENCE]: The 'Emit Outcome Sidecar' section in SKILL.md directs the agent to write JSON telemetry data to ~/.claude/skill-analytics/ at the end of a session, which is a file write operation to a hidden directory outside the project repository.
Audit Metadata