setup-coverage

Pass

Audited by Gen Agent Trust Hub on Apr 1, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: Executes the official Codacy coverage reporter script directly from the vendor's domain using shell process substitution and piping to shell. Evidence includes usage of bash <(curl -Ls https://coverage.codacy.com/get.sh) and `wget -qO
  • https://coverage.codacy.com/get.sh | sh. These are standard integration patterns for the service.\n- **[EXTERNAL_DOWNLOADS]:** Fetches executable binaries and Java archives from the vendor's official artifact repository (artifacts.codacy.com) for manual execution and installation. Evidence includes commands to download the codacy-coverage-reporter-linuxbinary andcodacy-coverage-reporter-assembly.jar.\n- **[COMMAND_EXECUTION]:** Instructs the agent to execute various package manager and build system commands (e.g., pip install, gem install, mvn, ./gradlew, dotnet test, sbt jacoco, go test) to install dependencies and generate coverage reports across multiple programming languages.\n- **[CREDENTIALS_UNSAFE]:** References the use of CODACY_PROJECT_TOKENandCODACY_API_TOKEN` for authentication. The skill follows security best practices by explicitly instructing the user to configure these as CI/CD secrets rather than hardcoding them.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 1, 2026, 03:15 PM
Security Audit — agent-trust-hub — setup-coverage