Test Driven Development

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:33 AM UTC
• Version: 2.0.0

Overview

This TDD skill is mostly normal development guidance, but it instructs agents to hand code work and commits to an external Claude CLI with broad working-tree scope.

Review this skill carefully before installing. It is useful as TDD advice, but you should not let it automatically send project code or working-tree changes to an external Claude CLI or create commits unless you explicitly want that and your repository policy allows it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The skill explicitly instructs use of an external model CLI ('claude -p') to implement code. In a real agent environment, routing project context or source code to an external provider can cause unauthorized data egress, violate provider restrictions, and bypass central audit or policy controls.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

bash

# Step 1: Implement (let it be thorough)
claude -p "Implement the feature with full TDD. Be thorough with tests."

# Step 2: De-sloppify (separate context, focused cleanup)
claude -p "Review all changes in the working tree. Remove:

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

This step sends the working tree to an external model for review and cleanup, which increases the chance of exposing proprietary code, secrets, or sensitive diffs. Because it is framed as reviewing 'all changes in the working tree,' the scope of potential data exfiltration is broad.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

claude -p "Implement the feature with full TDD. Be thorough with tests."

# Step 2: De-sloppify (separate context, focused cleanup)
claude -p "Review all changes in the working tree. Remove:
- Tests that verify language/framework behavior rather than business logic
- Redundant type checks that the type system already enforces
- Over-defensive error handling for impossible states

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The looped use of an external model for each feature normalizes repeated off-platform processing of project content. Repetition increases exposure surface and may leak sensitive implementation details feature-by-feature over time.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

bash

for feature in "${features[@]}"; do
  # Implement
  claude -p "Implement $feature with TDD."

  # De-sloppify
  claude -p "Cleanup pass: review changes, remove test/code slop, run tests."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The cleanup pass again directs project changes to an external model and specifically includes running tests after cleanup, implying a workflow that may combine source disclosure with autonomous modification. This compounds confidentiality and integrity risk by allowing an unapproved external system to influence code changes.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md

claude -p "Implement $feature with TDD."

  # De-sloppify
  claude -p "Cleanup pass: review changes, remove test/code slop, run tests."

  # Verify
  claude -p "Run build + lint + tests. Fix any failures."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

This line uses an external model to drive build, lint, and test remediation. While the direct data-egress risk may be somewhat lower than full implementation prompts, it still delegates project-aware troubleshooting to an external provider and can disclose source, errors, paths, and environment details.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md

claude -p "Cleanup pass: review changes, remove test/code slop, run tests."

  # Verify
  claude -p "Run build + lint + tests. Fix any failures."

  # Commit
  claude -p "Commit with message: feat: add $feature"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

Delegating commit creation to an external model can leak code and commit context while also enabling unauthorized or low-visibility repository modifications. In agentic workflows, auto-commit behavior is especially sensitive because it affects integrity and auditability of the codebase.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

claude -p "Run build + lint + tests. Fix any failures."

Commit

claude -p "Commit with message: feat: add $feature" done

text

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The invocation guidance says to use the skill when the user 'wants to build features or fix bugs using TDD' and 'wants integration tests,' which are broad conditions that overlap with many ordinary development requests. It does not provide clear exclusions or negative examples to distinguish when this skill should activate versus more general coding or testing skills.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.