test-health
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard git commands (
git log,git status,git remote get-url origin) to verify the state of the repository and the freshness of coverage artifacts. Evidence found inscripts/artifact-parser.jsandscripts/trend.js. - [COMMAND_EXECUTION]: In Full Mode, the skill can be instructed to run project-defined coverage commands such as
npm run coverageorpytestwhen the user provides the--collectflag. This is documented as an opt-in behavior inSKILL.md. - [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes external test reports and console output. However, this is assessed as safe due to the implementation of specific data parsers.
- Ingestion points: Coverage artifact files (LCOV, Cobertura XML, Istanbul JSON), test runner
stdout, and git metadata processed inscripts/artifact-parser.jsandscripts/count-parser.js. - Boundary markers: The workflow in
SKILL.mdincludes explicit gates (e.g., checkingscan_error) to handle malformed or missing data. - Capability inventory: The skill utilizes the
Bashtool for local command execution and writes trend data to a local directory (.claude/cache/test-health/). - Sanitization: The skill employs regex and
JSON.parseto extract only relevant metrics, preventing raw file content from being directly interpreted as agent instructions.
Audit Metadata