agile-tdd
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill installs and executes several shell scripts (such as
tdd-pre-write.sh,tdd-session-audit.sh, andtdd-record-mcp.sh) to enforce TDD workflows, perform project audits, and record evidence of testing. These scripts use standard system utilities likegit,find,awk, andstat. - [DYNAMIC_EXECUTION]: The audit framework in
templates/hooks/tdd-session-audit.sh.tmpldynamically loads shell code using thesourcecommand. It resolves paths to helper functions and project-type-specific audit fragments at runtime (e.g., sourcingaudit.partial.shfor Tauri projects). - [INDIRECT_PROMPT_INJECTION]: The skill ingests user input through the
$ARGUMENTSvariable when invoked via slash commands. It also reads and processes project-local configuration files (.tdd-guardrails.yml) and tool outputs, which are used to determine enforcement behavior.
Audit Metadata