subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection attacks where malicious instructions embedded in implementation plans could be executed by subagents.
- Ingestion points: Implementation plans (referenced as
docs/plans/feature-plan.mdin examples) are read inSKILL.mdand their content is interpolated into prompts for subagents inimplementer-prompt.mdandspec-reviewer-prompt.md. - Boundary markers: Absent. The task text is inserted into prompts without specific delimiters or instructions to the subagents to ignore potential instructions embedded within the plan text.
- Capability inventory: The implementer subagent is granted capabilities to modify the codebase, write and execute tests, and perform git commits via the
general-purposetool and environment access. - Sanitization: Absent. No evidence of validation or filtering is performed on the content of the plan files before they are processed by the agent.
Audit Metadata