Lightweight helper to enforce TDD-style loops for non-deterministic agents.

This skill is internally consistent with its purpose, but note that tdd.py will execute whatever shell commands it is given (tests, linter, and the --run command) using shell=True. Before installing or enabling autonomous invocation: (1) ensure pytest and any linters are trusted and present, (2) avoid passing untrusted inputs into --run/TEST_CMD/LINT_CMD to prevent command injection, (3) consider restricting which commands an agent may ask this skill to run or use sandboxing (containers, timeouts) when running untrusted code, and (4) be aware optional env vars (WARN_AS_ERROR, TEST_CMD, LINT_CMD) control behavior though they're not declared in the metadata.

Type: OpenClaw Skill Name: agents-skill-tdd-helper Version: 0.1.0 The `tdd.py` script contains multiple critical shell injection vulnerabilities. It uses `subprocess.run(..., shell=True)` to execute user-controlled input from command-line arguments (`--run`, `--tests`) and environment variables (`TEST_CMD`, `LINT_CMD`). This allows for arbitrary command execution on the host system, posing a significant Remote Code Execution (RCE) risk. While this is a severe vulnerability, there is no evidence of intentional malicious behavior (e.g., data exfiltration, backdoor installation) within the script itself, aligning it with a 'suspicious' classification rather than 'malicious'.