tdd-workflows-tdd-green
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the interpolation of the
$ARGUMENTSvariable in the implementation playbook prompt. - Ingestion points: The
$ARGUMENTSvariable inresources/implementation-playbook.mdis used to ingest failing tests, which may come from untrusted sources like pull request bodies or external files. - Boundary markers: Absent. The prompt appends the untrusted data directly to the instructions without any delimiters (e.g., XML tags or triple backticks) or warnings to the agent to ignore embedded instructions within the tests.
- Capability inventory: The skill utilizes a
test-automatorsubagent designed to implement and potentially execute code to satisfy test requirements. - Sanitization: Absent. There is no evidence of input validation, escaping, or filtering of the content provided in
$ARGUMENTSbefore it is passed to the subagent. - [REMOTE_CODE_EXECUTION]: The skill creates a potential remote code execution vector by instructing a subagent to implement minimal code based on arbitrary input. If an attacker provides 'tests' that contain malicious code snippets or instructions, the agent might implement and execute them as part of the 'Green Phase' workflow.
- [COMMAND_EXECUTION]: The skill's primary function involves dynamic code generation and execution to verify test results. While this is the intended purpose of a TDD tool, the lack of isolation for the code being 'implement[ed] and run' represents an inherent security risk in environments with sensitive data.
Audit Metadata