The Agent Skills Directory

[COMMAND_EXECUTION]: The skill automates the execution of local test suites (e.g., pytest, jest, vitest, go, cargo) to facilitate a TDD workflow. It uses the subprocess module with argument lists (non-shell mode), which effectively mitigates the risk of command injection from file names or project configurations.
[COMMAND_EXECUTION]: The SKILL.md file provides instructions for the agent to call local utility scripts for framework detection and state management. These scripts are self-contained and perform legitimate workflow automation tasks.
[PROMPT_INJECTION]: The skill processes project manifests (like package.json and pyproject.toml) and CI configuration files to detect the testing environment. This ingestion of untrusted local data is handled safely by mapping findings to hardcoded command templates rather than executing arbitrary strings found in the files.
[PROMPT_INJECTION]: Indirect injection surface analysis:
Ingestion points: Project manifests, CI YAML files, and git diff output (via framework_detector.py and validate_red.py).
Boundary markers: Absent.
Capability inventory: Execution of local subprocesses and file system writes to a local .sc-tdd directory.
Sanitization: High; the skill uses fixed command templates and avoids shell execution, preventing malicious repository content from escalating privileges or executing arbitrary commands.
[SAFE]: No indicators of malicious behavior, such as data exfiltration, credential theft, or unauthorized network access, were found in the skill's code or instructions.

sc-tdd