plan-test-coverage
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates in a planning-only capacity, with a strict Preservation Contract that explicitly prohibits writing tests or modifying application code during the audit phase. This limits the agent's agency to analytical tasks.
- [COMMAND_EXECUTION]: The skill recommends using standard local development commands such as
npm test -- --coverageandnpx vitest run --coverageto collect baseline data. These are routine development operations with no evidence of malicious parameters or injection of external data into the shell environment. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes project source code to derive user stories.
- Ingestion points: Project routes, handlers, screens, and test files are analyzed to derive user stories.
- Boundary markers: None explicitly defined for the code analysis process.
- Capability inventory: Limited to read-only code analysis and execution of local coverage tools; no file-write or network-out capabilities are present in the provided instructions.
- Sanitization: No specific sanitization logic is mentioned for the analysis of external code content. Given the skill's primary purpose is code analysis and it lacks autonomous side-effect capabilities in this phase, the surface is considered a safe implementation.
Audit Metadata