tdd-dev-cycle
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate project management and development instructions without any hidden or malicious intent.
- [NO_CODE]: The skill consists entirely of natural language instructions in its SKILL.md file; it does not include any executable scripts, binaries, or configuration files, which significantly limits the potential for direct malicious behavior.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a process for ingesting and analyzing untrusted data from project files, creating a potential surface for indirect injection. * Ingestion points: The agent reads tasks and requirements from 'docs/backlog/' and 'docs/requirements/'. * Boundary markers: No specific delimiters or 'ignore' instructions are provided to separate user-provided task descriptions from system instructions. * Capability inventory: The skill utilizes git commits, file movement, and the execution of automated tests. * Sanitization: No sanitization or validation of the content within the backlog files is performed prior to the analysis phase.
Audit Metadata