sp-subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external markdown files (implementation plans) to extract task instructions for subagents, creating a surface where malicious data could influence agent behavior.
- Ingestion points: The
scripts/task-briefutility extracts text from user-provided plan files to generate subagent instructions. - Boundary markers: Subagent templates (e.g.,
implementer-prompt.md) lack explicit delimiters or instructions to ignore commands embedded within the data, making subagents potentially compliant with injected instructions. - Capability inventory: Dispatched subagents possess the authority to modify the filesystem, execute shell commands for testing, and commit changes to the git repository.
- Sanitization: The extraction logic in
scripts/task-briefuses basic pattern matching without sanitization or validation of the ingested content.
Audit Metadata