subagent-driven-development

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and execute tasks from a plan file, which acts as a vector for malicious instructions embedded in the task data.\n
  • Ingestion points: The agent reads a 'plan file' in Step 1 of both the Sequential and Parallel execution processes (SKILL.md) to define its objectives.\n
  • Boundary markers: The skill lacks explicit delimiters (like XML tags or triple quotes) or specific 'ignore-embedded-instructions' warnings in the prompts generated for subagents when interpreting the plan.\n
  • Capability inventory: The subagents are dispatched with general-purpose tools, giving them the capability to modify the filesystem, write code, and execute tests based on the task content.\n
  • Sanitization: There is no requirement or evidence for the sanitization or validation of the plan file content before it is used to construct prompts for subagents.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 01:10 AM
Security Audit — agent-trust-hub — subagent-driven-development