coverage
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill scans application source files (routes, components, API endpoints) and existing test files (*.spec.ts, *.spec.js) to generate a coverage report and recommend new tests. This ingestion of untrusted data from the codebase creates a surface for instructions embedded within the files to influence agent behavior.
- Ingestion points: Source code files (Next.js, React, Vue routes), API controller files, and test specifications (Step 1 and Step 2 in SKILL.md).
- Boundary markers: The skill does not define specific delimiters or include instructions for the agent to ignore potentially embedded directives within the analyzed files.
- Capability inventory: The skill reads multiple file types across the project and can invoke the /pw:generate tool to create new files based on its analysis.
- Sanitization: No explicit logic or filtering is provided to validate the content extracted from the analyzed files before it is processed by the agent.
Audit Metadata