testing

Fail

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill documents integration with the Codecov coverage reporting service using its official bash uploader.
  • Evidence: The GitHub Actions example in SKILL.md uses the command bash <(curl -s https://codecov.io/bash) to upload coverage data.
  • Context: Codecov is a well-known developer service, and this pattern is a standard (though documented) method for CI/CD integration.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied C++ source code to generate unit tests, which creates a surface for indirect instructions to be processed by the agent.
  • Ingestion points: The code_to_test property in the input_schema defined in SKILL.md accepts arbitrary strings of C++ code.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified in the prompt schema.
  • Capability inventory: The skill is primarily instructional and generates code templates for testing, benchmarking, and fuzzing; it does not perform automated execution of the generated code.
  • Sanitization: The skill does not define specific validation or sanitization rules for the input code contents.
Recommendations
  • HIGH: Downloads and executes remote code from: https://codecov.io/bash - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 29, 2026, 02:37 AM