test-coverage
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by reading the local project's source code (Step 2) and git commit history (Step 4). While these sources could theoretically contain adversarial instructions, this ingestion is necessary for the skill's primary purpose of analyzing code for testing gaps. The risk is minimized as the data is used for identifying logic branches rather than direct command construction.
- [COMMAND_EXECUTION]: The skill discovers and executes the project's existing test suite (Step 8) by identifying local configuration files like
package.json,pytest.ini, orgo test. This is a core functionality required to verify that the generated tests are functional and pass within the user's specific environment.
Audit Metadata