dart-collect-coverage
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the 'coverage' package via Dart's official package manager and the 'lcov' utility via Homebrew. These are standard tools for the platform and originate from well-known sources.
- [COMMAND_EXECUTION]: The skill utilizes shell commands to run tests, collect metrics from the Dart VM service, and generate HTML reports. It documents the use of the '--disable-service-auth-codes' flag, which is a standard practice for local automated coverage collection tools to interact with the VM service.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for processing test coverage data, creating a potential surface for indirect injection if malicious test results are processed. 1. Ingestion points: The agent reads and processes 'coverage/lcov.info' (SKILL.md). 2. Boundary markers: No explicit boundary markers or 'ignore' instructions are used for the processed data. 3. Capability inventory: The skill has the capability to execute shell commands ('dart', 'flutter', 'lcov', 'genhtml') based on the coverage workflow (SKILL.md). 4. Sanitization: No sanitization of the coverage file content is performed before processing.
Audit Metadata