coverage-analysis

Pass

Audited by Gen Agent Trust Hub on Jul 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions to execute various CLI tools for building and instrumenting code, including clang++, g++, and cargo, as well as tools for analyzing coverage data such as llvm-profdata, llvm-cov, and gcovr.
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install packages from recognized repositories, specifically 'gcovr' from PyPI and 'cargo-binutils' and 'rustfilt' from the Rust crates registry.
  • [REMOTE_CODE_EXECUTION]: The skill includes a step to dynamically generate a shell script named 'generate_html' using a heredoc and subsequently execute it after modifying its permissions with 'chmod +x'. This script automates the generation of HTML coverage reports.
  • [PROMPT_INJECTION]: The skill possesses a surface for Indirect Prompt Injection as it processes untrusted data from an external fuzzing corpus.
  • Ingestion points: The 'execute-rt.cc' utility reads and processes all regular files from a user-specified directory.
  • Boundary markers: No delimiters or explicit instructions are provided to ignore potentially malicious embedded instructions within the corpus data.
  • Capability inventory: The skill environment permits subprocess execution (fork/waitpid), file system operations, and external tool invocation.
  • Sanitization: The content of the corpus files is not sanitized or validated before being passed to the target function for analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 18, 2026, 12:07 PM
Security Audit — agent-trust-hub — coverage-analysis