tdd-workflow

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill uses natural language user journeys to drive the generation of tests and implementation code. This design presents a surface for indirect prompt injection where malicious instructions embedded in user-supplied journeys could potentially influence the generated code.
  • Ingestion points: User journeys provided in the workflow steps of SKILL.md.
  • Boundary markers: Absent; there are no instructions to the agent to sanitize or ignore embedded instructions within the user-provided journey text.
  • Capability inventory: The skill involves shell command execution (npm) and automated browser testing (Playwright).
  • Sanitization: Absent.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to manage the testing lifecycle.
  • Evidence: Use of npm test, npm run test:coverage, and npm run lint within the development workflow.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 05:24 AM