subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon external implementation plans and task briefs. Malicious instructions embedded in these files could override the intended behavior of the subagents.
- Ingestion points: The implementation plan file (
PLAN_FILE) and the extracted task briefs (BRIEF_FILE) provided to the implementer and reviewer subagents. - Boundary markers: The prompt templates (
implementer-prompt.md,task-reviewer-prompt.md) lack explicit delimiters or instructions to ignore embedded commands that attempt to escape the implementation scope. - Capability inventory: The skill dispatches new subagents, manages git worktrees and commits, and executes repository-level test suites which can run arbitrary code.
- Sanitization: There is no evidence of validation or sanitization of the input plan data before it is interpolated into prompts or used to drive execution steps.
- [COMMAND_EXECUTION]: The skill automates various shell-based operations, including git commands and test execution. In the absence of strict input validation, a compromised implementation plan could direct the agent to execute unauthorized commands or scripts within the developer's environment.
Audit Metadata