coverage-analysis
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to execute various CLI tools for building and instrumenting code, including clang++, g++, and cargo, as well as tools for analyzing coverage data such as llvm-profdata, llvm-cov, and gcovr.
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install packages from recognized repositories, specifically 'gcovr' from PyPI and 'cargo-binutils' and 'rustfilt' from the Rust crates registry.
- [REMOTE_CODE_EXECUTION]: The skill includes a step to dynamically generate a shell script named 'generate_html' using a heredoc and subsequently execute it after modifying its permissions with 'chmod +x'. This script automates the generation of HTML coverage reports.
- [PROMPT_INJECTION]: The skill possesses a surface for Indirect Prompt Injection as it processes untrusted data from an external fuzzing corpus.
- Ingestion points: The 'execute-rt.cc' utility reads and processes all regular files from a user-specified directory.
- Boundary markers: No delimiters or explicit instructions are provided to ignore potentially malicious embedded instructions within the corpus data.
- Capability inventory: The skill environment permits subprocess execution (fork/waitpid), file system operations, and external tool invocation.
- Sanitization: The content of the corpus files is not sanitized or validated before being passed to the target function for analysis.
Audit Metadata