中风险
仓库自带测试命令可能在未要求审查或隔离的情况下执行任意代码
原文依据：5 处发现了什么
该 Skill 明确偏好运行仓库内的包装器或脚本，并要求完成前执行完整测试套件，但没有要求先审查命令内容、征得用户确认或在隔离环境中运行。测试脚本与构建包装器本质上可以执行任意程序；文档还允许大型测试连接外部服务。
为什么需要注意
如果仓库或依赖不可信，运行测试可能读取当前进程可访问的文件或环境变量、改写工作区、启动下载或向外部服务发送请求。若本机存在云端或第三方服务凭据，集成测试还可能修改真实账户数据或产生费用。
该 Skill 的用途确实需要运行测试，这本身是正常且相关的；但其活动指令要求优先使用仓库自带包装器或脚本，并在完成前运行完整测试套件。若仓库不受信任或测试配置已被篡改，这些命令可按当前代理权限执行其中的程序；“大型”测试还明确允许访问外部服务。文中没有要求先检查脚本、隔离执行或确认外部副作用。因此存在有条件的文件、凭据和网络风险，但证据不表示恶意代码已经存在或执行。用户可要求作者加入脚本审查、沙箱、无凭据环境及默认禁网约束。
- **Language and build system** — `package.json`, `pom.xml`/`build.gradle`, `pyproject.toml`, `go.mod`, `Cargo.toml`, `Gemfile`, a `Makefile`- **Checked-in wrappers** — prefer `./gradlew`, `./mvnw`, `make test`, or a repo script over globally installed tools- **Test framework and configuration** — and how it runs a single focused test vs the full suite- **Existing conventions** — where tests live, how files are named, what patterns neighboring tests follow- **Documented commands** — README, CONTRIBUTING, and CI workflows show the commands that actually gate mergesRun the repository's focused-test command during the loop and its full-suite command before completion. Never assume a default like `npm test` — a Gradle, Cargo, or pytest project has its own equivalent.查看另外 4 个位置
| Size | Constraints | Speed | Example ||------|------------|-------|---------|| **Small** | Single process, no I/O, no network, no database | Milliseconds | Pure function tests, data transforms || **Medium** | Multi-process OK, localhost only, no external services | Seconds | API tests with test DB, component tests || **Large** | Multi-machine OK, external services allowed | Minutes | E2E tests, performance benchmarks, staging integration |After completing any implementation:- [ ] Every new behavior has a corresponding test- [ ] The full suite passes, run with the repository's own test command (`npm test`, `./gradlew test`, `pytest`, `go test ./...`, ...)- [ ] Bug fixes include a reproduction test that failed before the fixThe TDD cycle is universal; the commands are not. Before writing the first test, discover how *this* repository tests, and use its commands for every RED, GREEN, and verification step:- **Language and build system** — `package.json`, `pom.xml`/`build.gradle`, `pyproject.toml`, `go.mod`, `Cargo.toml`, `Gemfile`, a `Makefile`- **Checked-in wrappers** — prefer `./gradlew`, `./mvnw`, `make test`, or a repo script over globally installed tools- **Test framework and configuration** — and how it runs a single focused test vs the full suite- **Existing conventions** — where tests live, how files are named, what patterns neighboring tests followRun the repository's focused-test command during the loop and its full-suite command before completion. Never assume a default like `npm test` — a Gradle, Cargo, or pytest project has its own equivalent.