subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes implementation plans and task descriptions from external files, creating a surface for indirect prompt injection.
- Ingestion points: The main workflow in
SKILL.mdinvolves reading plan files (e.g.,docs/plans/feature-plan.md), the content of which is then passed into theimplementer-prompt.mdandspec-reviewer-prompt.mdtemplates. - Boundary markers: Task content is delimited by Markdown headers in the subagent prompts. However, there are no explicit instructions for the subagents to ignore or filter potentially malicious commands or instructions that might be embedded within the plan text itself.
- Capability inventory: The implementer subagent is granted high-privilege capabilities including writing source code, executing shell commands for verification/testing, and performing git commits.
- Sanitization: The skill lacks mechanisms to sanitize, validate, or escape the plan content before it is interpolated into subagent instructions, relying instead on the subagent's internal reasoning.
Audit Metadata