subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads implementation plans from external markdown files and passes the extracted task text to subagents as primary goals. If the plan file is malicious, it could lead to the execution of unintended commands.
- Ingestion points: The skill uses the read_file tool to ingest content from 'docs/plans/feature-plan.md' and other plan artifacts.
- Boundary markers: The instructions for the delegate_task tool do not specify the use of delimiters or 'ignore instructions' warnings when passing plan-derived context to subagents.
- Capability inventory: The subagents are granted terminal and file toolsets, which provide the capability to execute shell commands and modify the filesystem.
- Sanitization: The skill lacks validation or sanitization steps to ensure that the content read from plan files does not contain prompt injection payloads.
Audit Metadata