subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Mar 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No indicators of malicious intent, obfuscation, or unauthorized data exfiltration were found. The skill is designed to manage complex development tasks with a focus on code quality and specification compliance.
- [COMMAND_EXECUTION]: The skill utilizes a suite of workflow tools (including
warcraft_status,warcraft_worktree_create,warcraft_worktree_commit, andwarcraft_merge) to manage the development lifecycle within isolated git worktrees. These commands are integral to the skill's stated purpose of providing a structured implementation environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes external implementation plans which represent a potential surface for indirect prompt injection. This risk is effectively mitigated by the skill's architecture: a 'Spec Compliance Reviewer' subagent is explicitly instructed to verify the actual code changes against the requirements without trusting implementer reports, and a subsequent 'Code Quality Reviewer' must approve the code before the task is marked complete. These review loops act as critical sanitization and verification layers.
Audit Metadata