subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process implementation plans, which are then used as the primary instructions for subagents. This creates a vulnerability surface where a malicious or poorly-formed plan could influence subagent behavior.
- Ingestion points: Plan files are read and task text is extracted in
SKILL.mdand then interpolated into subagent prompts inimplementer-prompt.mdandspec-reviewer-prompt.md. - Boundary markers: The prompt templates use Markdown headers (e.g.,
## Task Description,## What Was Requested) to separate external content from system instructions. - Capability inventory: Subagents are expected to perform file writes, run tests (command execution), and commit code (git operations), which increases the potential impact of a successful injection.
- Sanitization: The skill does not explicitly mention sanitization or escaping of the task text before it is inserted into subagent prompts.
Audit Metadata