Kinema's TDD Injector (CLAUDE.md generator)

• Outcome: Review
• Latest audit: Jul 16, 2026 · 7:56 AM UTC
• Version: 1.4.1

Overview

This skill is mostly a disclosed TDD instruction-file generator, but it also allows persistent agent-instruction changes, optional repository renames, and project config-code edits that need careful review.

Install only if you intend this skill to modify repository-level agent instruction files. Before running it, confirm the target repository and review any proposed CLAUDE.md or AGENTS.md diff; decline optional git mv migrations or config.py generation unless you specifically want those codebase changes and can review them like normal code.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill clearly instructs reading and writing files in the target repository, including creating temporary files, modifying or appending to CLAUDE.md, and deleting drafts, yet no permissions are explicitly declared. This creates a trust and consent gap: a user or platform may underestimate the skill's write capabilities and allow repository modifications without adequate review.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill is presented as a one-time CLAUDE.md injector, but this section also offers to rename repository test directories with git mv. That exceeds the advertised scope and can alter project structure in ways the user did not expect from a documentation-generation skill.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This instruction tells the agent to write project implementation code/config logic into the repository when a custom configuration-source combination is chosen. That is a major expansion from generating CLAUDE.md into modifying executable project code, increasing the risk of unintended behavior, insecure config-loading patterns, or supply-chain style tampering under the guise of documentation setup.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The skill later tells users it does not automatically migrate tests, but earlier workflow explicitly offers immediate test-directory migration. This inconsistency can mislead users about what changes the skill may perform, weakening informed consent around repository modifications.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The documented trigger phrases are broad enough that the skill may activate on generic repository-setup requests without strong confirmation of user intent or repository scope. Because this skill writes or upgrades persistent instruction files such as CLAUDE.md or AGENTS.md, accidental activation can permanently alter agent behavior in the target repo and propagate unintended testing rules into future sessions.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The activation examples include broad phrases like 'set up testing methodology,' which could match ordinary conversation and trigger a repository-writing skill in contexts where the user did not intend to invoke it. Because this skill can modify files, overbroad activation increases the chance of unintended changes.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill description and early workflow direct creation of temporary files, comparison against existing CLAUDE.md, writes/appends, and cleanup deletions, but do not present a prominent upfront warning that repository files will be modified. Users may invoke it thinking it is advisory, when it is operational and destructive to temporary artifacts.

Static analysis

No suspicious patterns detected.