subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied implementation plans, extracting task descriptions and instructions that are passed directly to subagents. This constitutes a standard surface for indirect prompt injection where a malicious plan could attempt to manipulate subagent behavior.
- Ingestion points: Implementation plan files (read by
scripts/task-brief) and report files generated by subagents (read by reviewers). - Boundary markers: The prompt templates in
implementer-prompt.mdandtask-reviewer-prompt.mduse clear Markdown headers and instructional blocks to separate system instructions from the injected content. - Capability inventory: Operations are limited to local file system management within the
.superpowers/sdd/directory and standard read-only git operations for diffing and logging. - Sanitization: Content is extracted based on Markdown headings using
awkwithout further sanitization or escaping of the internal text content.
Audit Metadata