coverage-analyzer
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to run test suites and coverage reports (e.g.,
phpunit,jest,npm test,ddev exec). These operations are consistent with the skill's primary purpose of analyzing project code coverage. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided code and test outputs for analysis. While this represents a potential surface for indirect prompt injection if the source code contains adversarial instructions, the risk is mitigated by the skill's focus on structured metrics (line/branch coverage) and the lack of high-privilege capabilities beyond the test environment.
Audit Metadata