subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it ingests task descriptions from external plan files. Ingestion points: Development plans (e.g., docs/tmp/feature-plan.md) are read to extract implementation tasks. Boundary markers: The skill lacks protective delimiters or instructions to ignore malicious content when passing task text to subagents. Capability inventory: Subagents are granted permissions to modify files, execute shell commands for testing, and perform git commits. Sanitization: There is no validation or sanitization of task content before delegation.
- [COMMAND_EXECUTION]: The skill's instructions mandate high autonomy that reduces user oversight. It explicitly commands the agent to 'not stop for human confirmation' between tasks in a plan. This allows a potentially malicious or flawed plan to be executed and committed across multiple steps before a human has the opportunity to review the changes.
Audit Metadata