coverage-analysis
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- Command Execution: The skill executes
dotnet testand bundled PowerShell scripts to gather and analyze coverage metrics. These operations are necessary for the skill's primary function of code analysis.\n- Project Configuration Updates: The skill can add NuGet packages likecoverlet.collectororMicrosoft.Testing.Extensions.CodeCoverageto test projects when a coverage provider is missing. This is a standard procedure for .NET coverage analysis but involves modifying project files.\n- External Tool Acquisition: To generate enhanced reports, the skill installs thereportgeneratortool from NuGet. This is a well-known service in the .NET ecosystem, and the action is performed to fulfill the optional reporting phase.\n- Data Ingestion and Analysis (Indirect Prompt Injection): The skill parses Cobertura XML files to calculate CRAP scores. This represents a potential surface for indirect prompt injection if the ingested data contains malicious instructions.\n - Ingestion points: Cobertura XML files processed in
Compute-CrapScores.ps1andExtract-MethodCoverage.ps1.\n - Boundary markers: None present in the XML parsing logic to distinguish between data and instructions.\n
- Capability inventory: The skill can execute shell commands (
dotnet test), write to the filesystem, and install global tools.\n - Sanitization: The scripts use PowerShell's XML parser but do not explicitly sanitize method or class names before they are surfaced in the agent's summary.
Audit Metadata