team-builder
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads raw content from local markdown files to define sub-agent personas without proper isolation or sanitization.\n
- Ingestion points: Agent persona instructions are read from markdown files in
./agents/and~/.claude/agents/.\n - Boundary markers: The skill lacks boundary markers or 'ignore embedded instructions' warnings when merging file content with the task description, using a simple concatenation:
"{agent file content}\n\nTask: {task description}".\n - Capability inventory: The skill uses the Agent tool to spawn sub-agents which then execute logic based on the unvalidated file content.\n
- Sanitization: No sanitization or validation is performed on the markdown files before they are used as instructions for the sub-agents.
Audit Metadata