subagent-driven-development

Pass

Audited by Gen Agent Trust Hub on Mar 20, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No indicators of malicious intent, obfuscation, or unauthorized data exfiltration were found. The skill is designed to manage complex development tasks with a focus on code quality and specification compliance.
  • [COMMAND_EXECUTION]: The skill utilizes a suite of workflow tools (including warcraft_status, warcraft_worktree_create, warcraft_worktree_commit, and warcraft_merge) to manage the development lifecycle within isolated git worktrees. These commands are integral to the skill's stated purpose of providing a structured implementation environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external implementation plans which represent a potential surface for indirect prompt injection. This risk is effectively mitigated by the skill's architecture: a 'Spec Compliance Reviewer' subagent is explicitly instructed to verify the actual code changes against the requirements without trusting implementer reports, and a subsequent 'Code Quality Reviewer' must approve the code before the task is marked complete. These review loops act as critical sanitization and verification layers.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 20, 2026, 11:46 PM