coverage-gap-finder
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides instructions for a legitimate software engineering workflow. It uses benign git commands, such as
git log, to calculate code churn and prioritize testing efforts. The operations are local to the repository and do not involve unauthorized data access, persistence, or network exfiltration.- [INDIRECT_PROMPT_INJECTION]: The skill involves processing external data in the form of coverage reports and repository logs, which constitutes an indirect prompt injection surface. - Ingestion points: Untrusted coverage reports (e.g., Istanbul, coverage.py) and git log output are ingested during the diagnostic steps.
- Boundary markers: The instructions do not specify use of delimiters or 'ignore' instructions for the ingested data.
- Capability inventory: The skill uses diagnostic reasoning and suggests execution of standard development tools for report generation.
- Sanitization: There is no specific requirement for the agent to sanitize or validate the content of the coverage reports before analysis.
Audit Metadata