subagent-driven-development
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes implementation plans and uses their content to instruct subagents with broad file-system and execution capabilities.
- Ingestion points: In
SKILL.md, thescripts/task-briefutility extracts raw task descriptions from implementation plan files (e.g.,PLAN_FILE) provided by the user or external sources. - Boundary markers: The prompt templates for subagents (
implementer-prompt.mdandtask-reviewer-prompt.md) use markdown headers to separate task text but lack explicit delimiters or instructions for the subagent to ignore potentially malicious directions embedded within the extracted text. - Capability inventory: The subagents are granted significant capabilities, including the ability to implement code, write and execute tests (
implementer-prompt.md), and read/verify diffs (task-reviewer-prompt.md). - Sanitization: There is no evidence of sanitization, validation, or escaping of the plan file content before it is interpolated into subagent prompts.
Audit Metadata