team-builder
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill loads content from external markdown files (agent personas) and user-provided task descriptions to construct a prompt for subagents. The absence of boundary markers or sanitization could allow malicious instructions within an agent file to hijack the subagent's execution.
- Ingestion points: Reads files from
./agents/**/*.mdand~/.claude/agents/**/*.mdas specified in the 'Configuration' section. - Boundary markers: None; the instructions use a simple concatenation:
{agent file content}\n\nTask: {task description}in Step 4. - Capability inventory: Utilizes the Agent tool to spawn
general-purposesubagents in parallel. - Sanitization: No validation or filtering is performed on the loaded content or user input before it is interpolated into the subagent prompt.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
claude agentscommand to discover agents available via the CLI, as described in Step 1.
Audit Metadata