test-driven-development
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill uses dogmatic and imperative language (e.g., "The Iron Law", "MANDATORY", "No exceptions") to enforce the TDD workflow. These instructions are intended to govern the agent's logic for its primary task and do not constitute an attempt to bypass security guardrails.
- [PROMPT_INJECTION]: The skill interacts with user-provided codebase and test files, which creates a surface for indirect prompt injection. 1. Ingestion points: The agent processes source code and test files during the TDD cycle. 2. Boundary markers: While markdown code blocks are used, there are no specific instructions to ignore embedded commands within the files being tested. 3. Capability inventory: The agent can execute shell commands via npm test. 4. Sanitization: The skill does not include explicit sanitization or validation of the input code files before execution.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute npm test to verify code changes. This is a standard and expected operation for developer tools and is used appropriately within the TDD context.
- [SAFE]: No indicators of malicious behavior, such as credential harvesting, data exfiltration, or obfuscated code, were found in the provided files.
Audit Metadata