setup-coverage
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill fetches and executes scripts and binaries from 'https://coverage.codacy.com/get.sh' and 'https://artifacts.codacy.com/bin/codacy-coverage-reporter/'. These are official vendor-managed resources belonging to Codacy used for the intended purpose of code coverage reporting.
- [COMMAND_EXECUTION]: The skill provides instructions to run development tools and test frameworks (e.g., pytest, maven, gradle, dotnet) to generate coverage data and to update CI/CD configurations.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: CI/CD workflows (.github/workflows/*.yml), build manifests (package.json, pom.xml), and coverage reports (lcov.info) (SKILL.md).
- Boundary markers: None identified.
- Capability inventory: File system writes to configuration files and shell command execution across various platforms.
- Sanitization: None identified.
- [DATA_EXFILTRATION]: The skill recommends storing authentication tokens (e.g., CODACY_PROJECT_TOKEN) in CI/CD secrets, following established security best practices for secret management.
Audit Metadata