subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local bash scripts (
scripts/review-package,scripts/task-brief,scripts/sdd-workspace) to interact with the git repository and manage temporary files (briefs, reports, and diffs) within the.superpowers/sdddirectory. - [PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it processes external implementation plans and subagent reports. However, this is inherent to its function as an orchestration tool.
- Ingestion points: The skill reads implementation plans via
scripts/task-briefand implementation reports through theimplementer-prompt.mdtemplate. - Boundary markers: The prompt templates for the subagents do not currently include explicit delimiters or instructions to ignore embedded malicious directions within the ingested data.
- Capability inventory: The orchestrated subagents are authorized to modify the filesystem, run tests, and commit code changes to the repository.
- Sanitization: There is no evidence of sanitization or filtering applied to the plan text or subagent reports before they are incorporated into the agent's context.
Audit Metadata