subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via the plan files it ingests.
- Ingestion points: Plan files (e.g., [plan-file]) are read by the main agent and their contents are used to generate prompts for implementation subagents.
- Boundary markers: The instructions lack explicit delimiters or instructions for subagents to ignore potential malicious commands embedded within the plan tasks.
- Capability inventory: Subagents are granted significant capabilities, including implementing code, writing and executing tests, and committing work to the repository.
- Sanitization: There is no evidence of sanitization or validation of the plan content before it is interpolated into subagent prompts.
Audit Metadata