tdd-workflow
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to detect the environment's package manager via a setup script (
node scripts/setup-package-manager.js --detect). This script is assumed to be part of the user's development environment or platform utility set. - [COMMAND_EXECUTION]: The workflow involves running project-specific test suites and coverage tools (e.g.,
npm test,bun test,playwright test) which involves executing code found within the user's project repository. - [INDIRECT_PROMPT_INJECTION]: The skill defines a process that ingests external data from the project context and user requirements to drive code generation and execution.
- Ingestion points: Reads project configuration files (
package.json, lockfiles,.claude/package-manager.json) and user-provided "User Journey" descriptions inSKILL.md. - Boundary markers: No specific boundary markers or instruction-isolation techniques are used when interpolating user requirements into test generation steps.
- Capability inventory: The skill utilizes capabilities for shell command execution, file system interaction (via test runners), and browser automation (via Playwright).
- Sanitization: No explicit input validation or sanitization logic is present for the data read from the project environment or user input.
Audit Metadata