skills/n0an/vivadicta/coverage-report/Gen Agent Trust Hub

coverage-report

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents and facilitates the execution of a local shell script, scripts/coverage/coverage.sh, to perform code coverage analysis. This includes running standard development tools like xcodebuild, swift test, xccov, and llvm-cov. It also includes maintenance commands for cleaning build directories using rm -rf as part of the clean build and coverage process.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and summarizes terminal output produced by the coverage script, which constitutes a potential attack surface for indirect prompt injection from test metadata.\n
  • Ingestion points: The agent reads terminal output from scripts/coverage/coverage.sh (as defined in SKILL.md), which includes module names, file paths, and test metrics.\n
  • Boundary markers: The skill instructions do not define specific delimiters or provide safety warnings to the agent regarding the handling of the script's output as untrusted data.\n
  • Capability inventory: The skill enables shell execution and interacts with local build artifacts located in directories such as .xcresult and .build.\n
  • Sanitization: No sanitization or validation of the metrics, file paths, or identifiers is specified before the agent processes and reports the resulting data.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 01:54 AM