plan-test-coverage

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill operates in a planning-only capacity, with a strict Preservation Contract that explicitly prohibits writing tests or modifying application code during the audit phase. This limits the agent's agency to analytical tasks.
  • [COMMAND_EXECUTION]: The skill recommends using standard local development commands such as npm test -- --coverage and npx vitest run --coverage to collect baseline data. These are routine development operations with no evidence of malicious parameters or injection of external data into the shell environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes project source code to derive user stories.
  • Ingestion points: Project routes, handlers, screens, and test files are analyzed to derive user stories.
  • Boundary markers: None explicitly defined for the code analysis process.
  • Capability inventory: Limited to read-only code analysis and execution of local coverage tools; no file-write or network-out capabilities are present in the provided instructions.
  • Sanitization: No specific sanitization logic is mentioned for the analysis of external code content. Given the skill's primary purpose is code analysis and it lacks autonomous side-effect capabilities in this phase, the surface is considered a safe implementation.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 05:55 AM
Security Audit — agent-trust-hub — plan-test-coverage