test-driven-development
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions explicitly mention processing untrusted inputs from web content and external data (e.g., via BrowserOS). This defines a clear ingestion point for potentially malicious instructions embedded in third-party data. While the skill instructs the agent to redact PII and secrets, it lacks formal boundary markers to prevent the agent from executing instructions found within that external content.
- Ingestion points: Web content and external data (SKILL.md).
- Boundary markers: None identified.
- Capability inventory: Shell command execution via 'rtk npm test', file system write access via 'MemoryStore', and file system read access via 'IssueTracker' and architecture discovery paths (SKILL.md).
- Sanitization: Guidelines exist to redact secrets/PII before sharing context with subagents.
- [COMMAND_EXECUTION]: The skill mandates the use of an execution proxy (e.g., 'rtk npm test') to perform terminal actions. This capability is required for the intended purpose of TDD (running test suites) but allows the agent to execute shell commands.
Audit Metadata