Skip to content
skillsafebeta
← Report library
Purpose / Other

Tdd Skill Security Audit

What the author says it does (original text)

Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions "red-green-refactor", or wants integration tests.

Independent security check

No obvious risks found in this check

Files checked
4
Risks found
0
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

4 instruction sections

The Skill is a test-driven-development guide that requires a one-test vertical-slice loop: write a failing test first, then the minimum implementation, without anticipating future features.

View source
SKILL.md:36In the instructionsOpen original file
- **Red before green.** Write the failing test first, then only enough code to pass it. Don't anticipate future tests or add speculative features.- **One slice at a time.** One seam, one test, one minimal implementation per cycle.- **Refactoring is not part of the loop.** It belongs to the review stage (see the `code-review` skill), not the red → green implementation cycle.

Before writing tests, it requires confirmation from the user about the public boundaries to test, so the testing scope needs explicit user agreement.

View source
SKILL.md:22In the instructionsOpen original file
**Test only at pre-agreed seams.** Before writing any test, write down the seams under test and confirm them with the user. No test is written at an unconfirmed seam. You can't test everything, so agreeing the seams up front is how testing effort lands on the critical paths and complex logic instead of every edge case.Ask: "What's the public interface, and which seams should we test?"

The Skill advises reading an existing CONTEXT.md and relevant ADRs so test terminology and interface constraints match the project; the supplied content does not instruct the agent to modify or upload those files.

View source
SKILL.md:10In the instructionsOpen original file
When exploring the codebase, read `CONTEXT.md` (if it exists) so test names and interface vocabulary match the project's domain language, and respect ADRs in the area you're touching.

The supporting guide recommends mocks only at external system boundaries and explicitly discourages mocking internal modules; its network calls and Stripe key appear in instructional examples, not as commands to execute.

View source
mocking.md:3In the instructionsOpen original file
Mock at **system boundaries** only:- External APIs (payment, email, etc.)- Databases (sometimes - prefer test DB)- Time/randomness- File system (sometimes)Don't mock:- Your own classes/modules- Internal collaborators- Anything you control
mocking.md:24In the instructionsOpen original file
```typescript// Easy to mockfunction processPayment(order, paymentClient) {  return paymentClient.charge(order.total);}// Hard to mockfunction processPayment(order) {  const client = new StripeClient(process.env.STRIPE_KEY);  return client.charge(order.total);}```
Start here · InstructionsSKILL.md
tdd
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 2
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records4 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • mocking.mdFull text included
  • tests.mdFull text included
  • agents/openai.yamlFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • agents/openai.yamlSupporting file
  • mocking.mdSupporting file
  • tests.mdSupporting file

Operations mentioned in code and instructions

Read keys or account settings
mocking.md:32In the instructionsOpen original file
function processPayment(order) {  const client = new StripeClient(process.env.STRIPE_KEY);  return client.charge(order.total);
Connect to websites
mocking.md:44In the instructionsOpen original file
const api = {  getUser: (id) => fetch(`/users/${id}`),  getOrders: (userId) => fetch(`/users/${userId}/orders`),
mocking.md:45In the instructionsOpen original file
  getUser: (id) => fetch(`/users/${id}`),  getOrders: (userId) => fetch(`/users/${userId}/orders`),  createOrder: (data) => fetch('/orders', { method: 'POST', body: data }),
mocking.md:46In the instructionsOpen original file
  getOrders: (userId) => fetch(`/users/${userId}/orders`),  createOrder: (data) => fetch('/orders', { method: 'POST', body: data }),};
Lines read
181
File checksum (to compare versions)
139750cdb3ba21145ee43a1b0431353b59638bdbccc963b5e2e46e2a03e7903f