apply-tdd
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill involves reading project manifest files (such as package.json or pyproject.toml) to determine project structure. While this represents a data ingestion surface, the risk is mitigated by the skill's own strict isolation policy.
- Ingestion points: Local project manifest and configuration files.
- Boundary markers: Explicit instructions in the references section prohibit tests from opening or asserting against real manifests, environment variables, or network services.
- Capability inventory: Execution of test runners and build scripts.
- Sanitization: Mandated use of mocks, fakes, and isolated temporary workspaces.
- [SAFE]: The instructions are purely professional and follow secure software development lifecycle (SDLC) principles. No malicious command injection, exfiltration, or obfuscation was found.
- [SAFE]: External links point exclusively to official documentation for standard development tools.
Audit Metadata