team-builder

Pass

Audited by Gen Agent Trust Hub on Mar 24, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill uses content from external markdown files to construct instructions for subagents, creating a surface for indirect prompt injection if those files contain malicious instructions.
  • Ingestion points: The skill searches for and reads markdown files from project-local directories (./agents/) and global configuration directories (~/.claude/agents/) as described in the 'Configuration' section of SKILL.md.
  • Boundary markers: The skill fails to use boundary markers or explicit delimiters when interpolating file content into prompts. In Step 4, it uses the pattern: prompt: "{agent file content}\n\nTask: {task description}", which does not clearly isolate the persona instructions from the task input.
  • Capability inventory: The skill utilizes the Agent tool to spawn subagents, providing them with instructions derived directly from the content of the discovered markdown files.
  • Sanitization: There is no evidence of sanitization, validation, or filtering of the content extracted from external markdown files before it is passed to the subagent's context.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 24, 2026, 07:42 AM
Security Audit — agent-trust-hub — team-builder