setup-coverage
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Executes the official Codacy coverage reporter script directly from the vendor's domain using shell process substitution and piping to shell. Evidence includes usage of
bash <(curl -Ls https://coverage.codacy.com/get.sh)and `wget -qO - https://coverage.codacy.com/get.sh | sh
. These are standard integration patterns for the service.\n- **[EXTERNAL_DOWNLOADS]:** Fetches executable binaries and Java archives from the vendor's official artifact repository (artifacts.codacy.com) for manual execution and installation. Evidence includes commands to download thecodacy-coverage-reporter-linuxbinary andcodacy-coverage-reporter-assembly.jar.\n- **[COMMAND_EXECUTION]:** Instructs the agent to execute various package manager and build system commands (e.g.,pip install,gem install,mvn,./gradlew,dotnet test,sbt jacoco,go test) to install dependencies and generate coverage reports across multiple programming languages.\n- **[CREDENTIALS_UNSAFE]:** References the use ofCODACY_PROJECT_TOKENandCODACY_API_TOKEN` for authentication. The skill follows security best practices by explicitly instructing the user to configure these as CI/CD secrets rather than hardcoding them.
Audit Metadata