tdd-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill uses natural language user journeys to drive the generation of tests and implementation code. This design presents a surface for indirect prompt injection where malicious instructions embedded in user-supplied journeys could potentially influence the generated code.
- Ingestion points: User journeys provided in the workflow steps of SKILL.md.
- Boundary markers: Absent; there are no instructions to the agent to sanitize or ignore embedded instructions within the user-provided journey text.
- Capability inventory: The skill involves shell command execution (npm) and automated browser testing (Playwright).
- Sanitization: Absent.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to manage the testing lifecycle.
- Evidence: Use of
npm test,npm run test:coverage, andnpm run lintwithin the development workflow.
Audit Metadata