configure-coverage

Pass

Audited by Gen Agent Trust Hub on Apr 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context injection placeholders (!pwd, !find) to execute environment discovery commands at load time. These commands are restricted to locating project configuration files such as package.json and vitest.config.ts.\n- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by reading local configuration files to determine project settings. Ingestion points: package.json, pyproject.toml, vitest.config.*, jest.config.*, and .project-standards.yaml. Boundary markers: None are present to delimit file content. Capability inventory: Access to shell execution via Bash and filesystem modification via Write/Edit. Sanitization: Content from these files is not validated or sanitized before processing.\n- [UNVERIFIABLE_DEPENDENCIES]: The skill provides instructions for installing well-known development tools and coverage providers including @vitest/coverage-v8, pytest-cov, and cargo-llvm-cov. These resources are sourced from official package registries.\n- [DATA_EXPOSURE_AND_EXFILTRATION]: References to external services like Codecov and Coveralls are used for reporting. Documentation and configuration templates follow best practices, correctly advising the use of CI provider secrets (e.g., CODECOV_TOKEN) for authentication.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 21, 2026, 01:17 AM
Security Audit — agent-trust-hub — configure-coverage