coverage-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [External Tool Installation]: The skill installs the
dotnet-reportgenerator-globaltoolfrom the official NuGet registry if it is not already available. This is a standard mechanism for adding report generation capabilities to a .NET development environment. - [Command Execution]: The skill utilizes system commands including
dotnet,git, and local PowerShell scripts to discover projects, execute tests, and analyze coverage data. These actions are necessary for the skill's core functionality and occur within the workspace context. - [Indirect Prompt Injection Surface]: The skill ingests untrusted data from external sources, which is a common security consideration for tools processing third-party files.
- Ingestion points: The skill reads Cobertura XML coverage reports and .NET project manifests (
.sln,.csproj) as defined inSKILL.mdand processed inscripts/Extract-MethodCoverage.ps1. - Boundary markers: The instructions do not specify explicit delimiters or "ignore" warnings for the interpolation of parsed XML data into the final agent response.
- Capability inventory: The skill executes local PowerShell scripts and invokes the
dotnetandgitCLIs to perform workspace analysis and file operations, as seen inreferences/setup-discovery.md. - Sanitization: While the skill uses structured XML parsing via
[xml], it does not implement additional sanitization or escaping of the content before it is summarized by the agent. - [Dynamic Environment Modification]: The skill adds the local tool installation path to the process
PATHenvironment variable. This allows the agent to invoke thereportgeneratortool during the session, which is a typical pattern for managing portable development tools.
Audit Metadata