tdd-workflow

SUSPICIOUS: the core TDD purpose is legitimate, but the skill is over-broad for that purpose because it grants arbitrary `npm`/`npx` execution and sends task metadata through Ruflo hooks. No clear credential harvesting or confirmed malware appears, but the install/execution trust and proportionality are weaker than a narrowly scoped TDD helper should have.