tdd-migrate
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to execute local CLI commands includingbun test,qlty check, andtldr. These commands are used to validate code generated during the migration process. - [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it processes untrusted external data.
- Ingestion points: The skill reads existing code from the user-provided
source_pathandpatternreference files in Steps 1 and 2 to guide the migration. - Boundary markers: The instructions do not specify any delimiters or warnings to the sub-agents to ignore potentially malicious instructions embedded in the source code comments or strings.
- Capability inventory: The orchestration environment has access to the
Bashtool (used in Steps 2, 3, and 5) for running tests and theWritetool for creating files. - Sanitization: There is no evidence of sanitization or filtering of the content read from source files before it is used to generate implementation code and unit tests.
Audit Metadata