team-builder
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads raw content from external markdown files and uses it to construct prompts for sub-agents without using boundary markers or sanitization. This allows a malicious markdown file to potentially hijack the behavior of the spawned sub-agents.\n
- Ingestion points: Markdown files found in
./agents/,~/.claude/agents/, or a user-provided custom path.\n - Boundary markers: Absent. Content is concatenated directly as
prompt: "{agent file content}\n\nTask: {task description}".\n - Capability inventory: The skill uses the
Agenttool to spawn and execute sub-agents based on the ingested content.\n - Sanitization: Absent. File content is read and passed verbatim to the tool.\n- [DATA_EXPOSURE]: The skill is designed to probe hidden application directories (
~/.claude/agents) and accepts arbitrary user-provided paths for globbing and reading files. While intended for agent personas, this capability could be misused to access data from other directories if they contain files that match the markdown search pattern.
Audit Metadata