subagent-driven-development — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited subagent-driven-development (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 2 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
→ Have an implementation plan with independent tasks? → Fresh subagent per task + two-stage review.
→ All tasks done: dispatch final code reviewer → finishing-a-development-branch.
Execute plan by dispatching fresh subagent per task, with two-stage review after each: spec compliance review first, then code quality review.
Why subagents: You delegate tasks to specialized agents with isolated context. By precisely crafting their instructions and context, you ensure they stay focused and succeed at their task. They should never inherit your session's context or history — you construct exactly what they need. This also preserves your own context for coordination work.
Core principle: Fresh subagent per task + two-stage review (spec then quality) = high quality, fast iteration
Use when you have a written implementation plan with mostly independent tasks and want to stay in the current session. For cross-session execution, use executing-plans instead.
Before multi-task plans: load long-task-continuation, create checkpoint, include in every implementer prompt.
Before dispatching an implementer, build a SubagentContextPacket instead of passing full conversation history. Include:
The packet is a compact handoff, not a substitute for evidence. Give raw excerpts or file refs for facts the subagent must verify.
Do not paste full chat transcripts, full session history, or unbounded logs into SubagentContextPacket. Prefer must-read excerpts, file refs, line/window hints, and explicit unsafe assumptions.
Use the least powerful model per role: mechanical (1-2 files, complete spec) → fast/cheap. Integration (multi-file, pattern matching) → standard. Architecture/design/review → most capable.
Each implementer prompt must include:
SubagentContextPacket when goal framing, long-task, or multi-agent work is activeTodoCheckpointDraftResumeStateHintThe implementer may update task-local evidence, but the controller owns the consolidated checkpoint.
Implementer subagents report one of four statuses. Handle each appropriately:
DONE: Proceed to spec compliance review.
DONE_WITH_CONCERNS: The implementer completed the work but flagged doubts. Read the concerns before proceeding. If the concerns are about correctness or scope, address them before review. If they're observations (e.g., "this file is getting large"), note them and proceed to review.
NEEDS_CONTEXT: The implementer needs information that wasn't provided. Provide the missing context and re-dispatch.
BLOCKED: The implementer cannot complete the task. Assess the blocker:
Never ignore an escalation or force the same model to retry without changes. If the implementer said it's stuck, something needs to change.
./implementer-prompt.md - Dispatch implementer subagent./spec-reviewer-prompt.md - Dispatch spec compliance reviewer subagent./code-quality-reviewer-prompt.md - Dispatch code quality reviewer subagentNever:
If subagent asks questions:
If reviewer finds issues:
After spec compliance and code quality review pass, update the consolidated checkpoint and run a drift check before moving to the next task.
If subagent fails task:
Required workflow skills:
Subagents should use:
Alternative workflow:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.