Security-sensitive paths should not be capped at one runnable check
Summary
The Ponytail skill currently treats a security path like other non-trivial logic and directs it to leave one runnable check. That ceiling is too low when a change crosses multiple trust boundaries or has several independent abuse cases.
Current rule:
Impact
An agent following the instruction literally can stop after one security check even when several properties need coverage. For example, one happy-path authentication check can satisfy the rule while object-level authorization, role separation, malformed credentials, or cross-tenant access remain untested.
This is an instruction-level testing weakness, not a claim of a runtime exploit in Ponytail itself.
Suggested change
Keep the one-check default for ordinary non-trivial logic, but exempt security-sensitive paths. Require relevant existing tests plus enough focused checks to cover each affected trust boundary and abuse case.
Example wording:
Security-sensitive paths are exempt: run relevant existing tests and add enough focused checks to cover each trust boundary and abuse case.
Source: DietrichGebert/ponytail