surface-coverage
Warn
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local system commands using
python3to run a coverage tool at~/.claude/harness/fdk/tools/surface-coverage.pyand performs automated testing viapython3 -m pyteston theharness/tests/test_surface_coverage.pyfile. - [DYNAMIC_EXECUTION]: Under Branch B01, the skill instructs the agent to dynamically write and execute custom scripts to handle route discovery for web frameworks that do not use file-based routing. It also includes capabilities to modify the user's project by injecting new test gates or CI steps.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from the product's codebase directory to determine coverage.
- Ingestion points: The product code directory defined in the input contract.
- Boundary markers: No explicit boundary markers or instructions to ignore embedded prompts in the analyzed code are defined.
- Capability inventory: The skill possesses the ability to read project files, execute Python scripts, write JSON reports, and modify project test configurations.
- Sanitization: There is no evidence of sanitization or filtering of the content read from the external codebase before it is processed by the agent.
Audit Metadata