subagent-plan-dev
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to modify the project's
.gitignorefile using shell commands (printf) to exclude the.sdd/state directory from version control. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository files, command outputs, and subagent reports, which is a potential vector for indirect prompt injection.
- Ingestion points: Repository files, command/test outputs, implementer reports, and reviewer findings as described in the 'Security Model' section of
SKILL.md. - Boundary markers: The 'Security Model' section explicitly defines trust boundaries and instructs the agent to treat external content as evidence rather than directives.
- Capability inventory: The skill allows for file system modifications (
.gitignore,.sdd/), execution of developer tools (git,npm), and the dispatching of subagents that modify the working tree. - Sanitization: The instructions mandate that any instruction-shaped content found in external sources must be treated as data and must not influence the controller's workflow or authorize new commands.
Audit Metadata