configure-coverage
Pass
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context injection placeholders (
!pwd,!find) to execute environment discovery commands at load time. These commands are restricted to locating project configuration files such aspackage.jsonandvitest.config.ts.\n- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by reading local configuration files to determine project settings. Ingestion points:package.json,pyproject.toml,vitest.config.*,jest.config.*, and.project-standards.yaml. Boundary markers: None are present to delimit file content. Capability inventory: Access to shell execution viaBashand filesystem modification viaWrite/Edit. Sanitization: Content from these files is not validated or sanitized before processing.\n- [UNVERIFIABLE_DEPENDENCIES]: The skill provides instructions for installing well-known development tools and coverage providers including@vitest/coverage-v8,pytest-cov, andcargo-llvm-cov. These resources are sourced from official package registries.\n- [DATA_EXPOSURE_AND_EXFILTRATION]: References to external services like Codecov and Coveralls are used for reporting. Documentation and configuration templates follow best practices, correctly advising the use of CI provider secrets (e.g.,CODECOV_TOKEN) for authentication.
Audit Metadata