subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates by reading and executing tasks from implementation plans (e.g., 'docs/plans/feature-plan.md'), which are then interpolated into subagent instructions.
- Ingestion points: Task requirements and full text are extracted from plan files and passed directly into the prompts for the implementer and spec-reviewer subagents via the templates in 'implementer-prompt.md' and 'spec-reviewer-prompt.md'.
- Boundary markers: The prompt templates utilize Markdown headers (e.g., '## Task Description', '## What Was Requested') to separate instructions from the potentially untrusted task content.
- Capability inventory: The subagents are capable of writing code, creating tests, executing commands to verify results, and potentially committing changes to the repository.
- Sanitization: No explicit sanitization or escaping of the ingested plan content is specified; however, the skill mandates a two-stage review process (spec compliance and code quality) which serves as a manual or automated check against unintended subagent behavior.
Audit Metadata