cargo-llvm-cov
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous shell commands for the agent to execute, including cargo installations, rustup component management, and coverage report generation (HTML, JSON, LCOV).
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the cargo-llvm-cov utility and LLVM toolchain components from official Rust registries.
- [EXTERNAL_DOWNLOADS]: CI/CD configuration examples reference highly reputable and widely used GitHub Actions for environment setup and coverage reporting, including actions from established community maintainers and services like Codecov and Coveralls.
- [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface where untrusted data could influence agent behavior.
- Ingestion points: Project source code (.rs files), test logs, and generated coverage data (LCOV, JSON) are read by the agent or processed by tools invoked by the agent.
- Boundary markers: No specific delimiters or warnings for the agent to ignore instructions within the project files are provided in the instructions.
- Capability inventory: The skill allows the agent to execute shell commands via the Bash tool, write files, and perform file system lookups.
- Sanitization: No explicit sanitization or filtering of external source code content is performed before processing or reporting results.
Audit Metadata