test-coverage-improver
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands such as
make coverage,uv run coverage html, andpnpm test:coverage. These are typical operations for triggering a project's test suite and generating coverage metrics. - [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it processes external data (coverage reports) that could potentially contain malicious instructions embedded in the source code or test outputs.
- Ingestion points: Coverage artifacts including
.coverage,coverage.xml, and terminal output from the coverage report. - Boundary markers: Not present; the skill does not wrap the ingested data in delimiters or provide instructions to ignore embedded commands.
- Capability inventory: The agent can write files to the
tests/directory and execute shell commands viamake,uv, andpnpm. - Sanitization: No sanitization or validation of the coverage data is mentioned before the agent uses it to draft new test scenarios.
Audit Metadata