subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and execute tasks from a plan file, which acts as a vector for malicious instructions embedded in the task data.\n
- Ingestion points: The agent reads a 'plan file' in Step 1 of both the Sequential and Parallel execution processes (SKILL.md) to define its objectives.\n
- Boundary markers: The skill lacks explicit delimiters (like XML tags or triple quotes) or specific 'ignore-embedded-instructions' warnings in the prompts generated for subagents when interpreting the plan.\n
- Capability inventory: The subagents are dispatched with general-purpose tools, giving them the capability to modify the filesystem, write code, and execute tests based on the task content.\n
- Sanitization: There is no requirement or evidence for the sanitization or validation of the plan file content before it is used to construct prompts for subagents.
Audit Metadata