test-health

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes standard git commands (git log, git status, git remote get-url origin) to verify the state of the repository and the freshness of coverage artifacts. Evidence found in scripts/artifact-parser.js and scripts/trend.js.
  • [COMMAND_EXECUTION]: In Full Mode, the skill can be instructed to run project-defined coverage commands such as npm run coverage or pytest when the user provides the --collect flag. This is documented as an opt-in behavior in SKILL.md.
  • [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes external test reports and console output. However, this is assessed as safe due to the implementation of specific data parsers.
  • Ingestion points: Coverage artifact files (LCOV, Cobertura XML, Istanbul JSON), test runner stdout, and git metadata processed in scripts/artifact-parser.js and scripts/count-parser.js.
  • Boundary markers: The workflow in SKILL.md includes explicit gates (e.g., checking scan_error) to handle malformed or missing data.
  • Capability inventory: The skill utilizes the Bash tool for local command execution and writes trend data to a local directory (.claude/cache/test-health/).
  • Sanitization: The skill employs regex and JSON.parse to extract only relevant metrics, preventing raw file content from being directly interpreted as agent instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 01:44 PM
Security Audit — agent-trust-hub — test-health