team-builder
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill uses content from external markdown files to construct instructions for subagents, creating a surface for indirect prompt injection if those files contain malicious instructions.
- Ingestion points: The skill searches for and reads markdown files from project-local directories (
./agents/) and global configuration directories (~/.claude/agents/) as described in the 'Configuration' section ofSKILL.md. - Boundary markers: The skill fails to use boundary markers or explicit delimiters when interpolating file content into prompts. In Step 4, it uses the pattern:
prompt: "{agent file content}\n\nTask: {task description}", which does not clearly isolate the persona instructions from the task input. - Capability inventory: The skill utilizes the
Agenttool to spawn subagents, providing them with instructions derived directly from the content of the discovered markdown files. - Sanitization: There is no evidence of sanitization, validation, or filtering of the content extracted from external markdown files before it is passed to the subagent's context.
Audit Metadata