coverage-analysis

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [External Tool Installation]: The skill installs the dotnet-reportgenerator-globaltool from the official NuGet registry if it is not already available. This is a standard mechanism for adding report generation capabilities to a .NET development environment.
  • [Command Execution]: The skill utilizes system commands including dotnet, git, and local PowerShell scripts to discover projects, execute tests, and analyze coverage data. These actions are necessary for the skill's core functionality and occur within the workspace context.
  • [Indirect Prompt Injection Surface]: The skill ingests untrusted data from external sources, which is a common security consideration for tools processing third-party files.
  • Ingestion points: The skill reads Cobertura XML coverage reports and .NET project manifests (.sln, .csproj) as defined in SKILL.md and processed in scripts/Extract-MethodCoverage.ps1.
  • Boundary markers: The instructions do not specify explicit delimiters or "ignore" warnings for the interpolation of parsed XML data into the final agent response.
  • Capability inventory: The skill executes local PowerShell scripts and invokes the dotnet and git CLIs to perform workspace analysis and file operations, as seen in references/setup-discovery.md.
  • Sanitization: While the skill uses structured XML parsing via [xml], it does not implement additional sanitization or escaping of the content before it is summarized by the agent.
  • [Dynamic Environment Modification]: The skill adds the local tool installation path to the process PATH environment variable. This allows the agent to invoke the reportgenerator tool during the session, which is a typical pattern for managing portable development tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 07:06 PM
Security Audit — agent-trust-hub — coverage-analysis