测试驱动开发

• Outcome: Pass
• Latest audit: Sep 28, 2026 · 4:07 AM UTC
• Version: 1.1.0

Overview

This TDD skill is coherent and transparent: it guides agents to write, edit, and run tests, with disclosed safeguards for risky test execution.

Use this skill when you want strict TDD discipline and are comfortable with the agent editing tests/code and running project test commands. Prefer installing from a trusted or pinned source, and review or sandbox untrusted test suites because tests can execute code; the skill itself tells the agent to get confirmation before destructive, out-of-repo, network, publish, or deployment actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 7)May include surrounding context.

md

**English** · [简体中文](README.md)

**What it does** — Test-driven development for *non-trivial* behavior: write or update a failing test FIRST, watch it fail **with evidence**, then write the minimal code to pass. The suite is a LIVING SPEC of the current target — as the target changes you EDIT / MERGE / DELETE tests, not only add.

**Why it's good** —
- A discriminative **right-size gate** that fixes over-triggering: engages on real logic / bugfix / behavior-change; skips renames, config-constants, spikes, generated code, docs.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file is in scope for vague-trigger review. The phrase "auto-triggers as you build" plus broad conditions like "implementing real logic" and "changing behavior of already-tested code" describe intent at a high level but do not define precise activation criteria, which could overlap with many ordinary coding tasks and cause unintended invocation.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.en.md (reported line 21)May include surrounding context.

md

**When to use** — auto-triggers as you build: implementing real logic (a function / method / endpoint / component with branching or edge cases) · fixing a bug (reproduce with a failing test first) · changing behavior of already-tested code; also the generator's inner discipline inside an agent loop.
**Not for** — trivial / mechanical edits (renames, formatting, comments, type-only, config/constant tweaks); throwaway prototypes / spikes; generated code; pure-docs changes.

**Install** — `npx skills add VincentJiang06/skills` (or `cp -R skills/test-driven-development ~/.claude/skills/`).

**Known limitations** (recorded honestly) — revert-to-red is candidate-granular: a vacuous assertion riding along genuine ones is not individually detected; the stress sentinel inside run_all is a deterministic proxy, the full 64K live run happens at major-version cadence only; per-assertion vacuity detection would need mutation testing, deliberately out of scope for the deterministic harness. The regex/count metrics in `grade.py` are construction-verified only on the committed fixtures; on external outputs they are evidence, not a verdict (stated in v1.1.0). The execution metrics (`green` / `revert_to_red`) count as evidence on an external output only when the candidate's diff vs `base/` touches no runner / infra file (conftest, vitest config, setup files), and even then they are evidence, not proof — a candidate-supplied conftest can turn an unfixed bug all-green (battery F-03); in the stress-sentinel scenario revert-to-red is not a vacuity backstop either (F-01). These grader channels stay open in `grade.py`; they are disclosed, not claimed closed. Open 1.1.0 battery items (one P2 in fix text plus several P3) are listed in the CHANGELOG. See `evals/README.md`.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The install command uses npx skills add VincentJiang06/skills without pinning a specific package version or immutable source. That allows whatever package/version resolves at install time to be executed, increasing supply-chain risk if the package is updated maliciously, compromised, or differs across environments.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

md

**什么时候用** —— 边写边自动触发：实现真逻辑（带分支 / 边界的函数·方法·端点·组件）·修 bug（先用失败测试复现）·改已测代码的行为；也是 agent loop 里 generator 的内在纪律。
**不适用** —— 平凡 / 机械改动（重命名、格式化、注释、纯类型、配置常量微调）；抛弃式原型 / 试验；生成代码；纯文档改动。

**安装** —— `npx skills add VincentJiang06/skills`（或 `cp -R skills/test-driven-development ~/.claude/skills/`）。

**已知限制**（如实记录）—— revert-to-red 以候选为粒度：混在真断言里「搭车」的空洞断言不会被单独识破；压力哨兵在 run_all 里是确定性代理检查，完整 64K 实况跑仅在大版本节奏执行；逐断言空洞检测需要变异测试，刻意不在确定性 harness 范围内。`grade.py` 的正则 / 计数类指标只在自带夹具上是构造性真值，拿去评外部产出时只算证据、不算终审（v1.1.0 写明）。执行类指标（`green` / `revert_to_red`）在外部产出上也只有在候选相对 `base/` 没动任何 runner / 基础设施文件（conftest、vitest 配置、setup 文件）时才算证据，且仍是证据不是证明 —— 候选自带的 conftest 可以让未修的 bug 全绿（battery F-03）；压力哨兵场景里 revert-to-red 也不是空洞测试的兜底（F-01）。这些评分器通道在 `grade.py` 里仍然开着，只是如实披露、不再宣称已堵。1.1.0 battery 的未修项（1 个修复文本里的 P2 + 若干 P3）见 CHANGELOG。详见 `evals/README.md`。

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

md

**什么时候用** —— 边写边自动触发:实现真逻辑(带分支 / 边界的函数·方法·端点·组件)·修 bug(先用失败测试复现)·改已测代码的行为;也是 agent loop 里 generator 的内在纪律。
**不适用** —— 平凡 / 机械改动(重命名、格式化、注释、纯类型、配置常量微调);抛弃式原型 / 试验;生成代码;纯文档改动。

**安装** —— `npx skills add VincentJiang06/skills`(或 `cp -R skills/test-driven-development ~/.claude/skills/`)。

**已知限制**(如实记录)—— revert-to-red 以候选为粒度:混在真断言里「搭车」的空洞断言不会被单独识破;压力哨兵在 run_all 里是确定性代理检查,完整 64K 实况跑仅在大版本节奏执行;逐断言空洞检测需要变异测试,刻意不在确定性 harness 范围内。`grade.py` 的正则 / 计数类指标只在自带夹具上是构造性真值,拿去评外部产出时只算证据、不算终审(v1.1.0 写明)。执行类指标(`green` / `revert_to_red`)在外部产出上也只有在候选相对 `base/` 没动任何 runner / 基础设施文件(conftest、vitest 配置、setup 文件)时才算证据,且仍是证据不是证明 —— 候选自带的 conftest 可以让未修的 bug 全绿(battery F-03);压力哨兵场景里 revert-to-red 也不是空洞测试的兜底(F-01)。这些评分器通道在 `grade.py` 里仍然开着,只是如实披露、不再宣称已堵。1.1.0 battery 的未修项(1 个修复文本里的 P2 + 若干 P3)见 CHANGELOG。详见 `evals/README.md`。

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

This is a second occurrence on the same line for another npx vitest invocation, and it carries the same risk: unpinned package execution can pull a different or malicious package version at runtime. In a skill file that tells an agent what commands to run, that risk is more meaningful because the command is prescriptive rather than merely descriptive.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

This duplicate finding corresponds to the second npx jest occurrence on the same line and has the same underlying issue: unpinned on-demand package execution. Because the file is an operational playbook for test-related subagents, the unsafe pattern is more dangerous than a casual mention since it may be copied directly into automated workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation condition is intentionally broad: it triggers whenever a user or reviewer corrects, deletes, reclassifies, or bypasses this skill's output. In practice, that can capture many ordinary review interactions and route them into persistent correction logging and follow-on regression-fixture creation, which expands the skill's influence beyond narrowly scoped TDD behavior and can cause over-collection of user edits or unnecessary workflow changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document presents "English" as an alternate link while marking "简体中文" as the active/default language, indicating a language choice has already been imposed. Under the policy, forcing a specific language without user opt-in is a natural-language policy issue unless the locale constraint is clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.