subagents-orchestration-guide
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains instructions that attempt to override standard agent behavior. Specifically, it states that its 'output discipline supersedes general-purpose prompt self-containment,' which is an instruction to disregard or deprioritize other parts of the agent's context.\n- [PROMPT_INJECTION]: The orchestrator is instructed that 'The user explicitly instructs and authorizes every subagent call named in the invoked recipe,' which could be interpreted as a mandate to bypass individual confirmations for potentially sensitive actions based on a broad initial authorization.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data and uses it to drive autonomous execution.\n
- Ingestion points: SKILL.md (Requirement Evidence Handoff passing requirements as verbatim user wording), references/monorepo-flow.md (ingesting codebase and UI analysis).\n
- Boundary markers: Uses 'Explicit Stop Points' and 'Handoff Contracts' to segment work, though the 'supersede' instruction potentially weakens these boundaries.\n
- Capability inventory: Executes git commit via Bash, invokes various subagents with tool access, and performs filesystem writes.\n
- Sanitization: No explicit sanitization or escaping of the user-provided requirements is described.\n- [COMMAND_EXECUTION]: The skill explicitly defines a cycle that executes shell commands, specifically 'git commit' with Bash after implementation phases.
Audit Metadata