z-bdd
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill consists entirely of instructional documentation for Behavior-Driven Development (BDD) workflows. It does not contain any executable scripts, command-line operations, or network requests.
- [SAFE]: The instructions explicitly promote security best practices, such as redacting credentials and private fixture data from reports and ensuring logs do not contain secrets.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent processes external, potentially untrusted data such as requirements, user requests, and Gherkin scenarios.
- Ingestion points: The agent is instructed to read external 'requests, existing requirements, domain language, and acceptance scenarios' (SKILL.md).
- Boundary markers: None explicitly defined in the instructions for separating data from instructions.
- Capability inventory: The skill describes executing scenarios through the project's existing runner and inspecting failures.
- Sanitization: The skill explicitly mandates the redaction of credentials and secrets from output evidence, which serves as a security control for data exposure.
Audit Metadata