zj-tdd
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is entirely instructional and does not contain any executable scripts, automated commands, or network operations. Analysis of all threat categories yielded no findings.
- [DATA_EXPOSURE_&_EXFILTRATION]: No sensitive file paths or credentials were found. The mention of
STRIPE_KEYinmocking.mdis part of a code example illustrating bad architectural patterns and does not constitute a credential harvest. - [REMOTE_CODE_EXECUTION]: There are no patterns involving remote script downloads or dynamic code execution. The provided code snippets are static examples for testing frameworks like Jest.
- [OBFUSCATION]: No obfuscated strings, zero-width characters, or homoglyph attacks were detected in the text or code examples.
- [INDIRECT_PROMPT_INJECTION]: The skill suggests reading a project-specific file (
ZJ-CONTEXT.md), but as it does not possess capabilities to write files, execute shell commands, or make network calls, there is no viable attack surface.
Audit Metadata