subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes implementation plans and specifications, interpolating the full text of tasks into the prompts for implementer and reviewer subagents.
- Ingestion points: Plan files and specification documents read via scripts/task-brief and standard file read operations.
- Boundary markers: The templates in implementer-prompt.md and spec-reviewer-prompt.md lack clear delimiters or instructions for the subagent to ignore embedded instructions within the interpolated task text.
- Capability inventory: The system has broad capabilities including arbitrary shell command execution via the general-purpose tool, git operations, and file system management.
- Sanitization: There is no evidence of sanitization or validation of the task text before it is interpolated into subagent prompts.
- [COMMAND_EXECUTION]: The skill relies on several local scripts (scripts/sdd-workspace, scripts/task-brief, scripts/review-package) and executes multiple git and shell commands to manage the workspace and generate diffs.
Audit Metadata