plan-test-coverage
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to run local test commands such as
npm test -- --coverageandnpx vitest run --coverage. These are standard practices in a software development lifecycle for gathering test coverage data and do not represent a security risk when used on local project code. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled project code and test files to derive stories and matrices. While this creates a potential surface for indirect injection if project files contain adversarial instructions, the skill's narrow scope (auditing and planning) and the inclusion of a 'Preservation Contract' to prevent unauthorized code changes or data fabrication mitigate this risk.
Audit Metadata