jacoco-analysis
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions and a script for parsing
jacoco.xmlcoverage reports which serves as an ingestion point for external data. - Ingestion points: The Python script
scripts/parse_jacoco.pyinreferences/gradle-parsing-and-ci.mdingests data from XML reports generated by the build process. - Boundary markers: There are no explicit boundary markers or instructions to ignore embedded content within the parsed XML data.
- Capability inventory: The skill references the execution of build tools (
mvnw) and conversion utilities (xml2lcov) in CI pipelines, though these are not directly controlled by the parsed data. - Sanitization: The provided Python snippet lacks explicit validation or sanitization of the extracted XML attributes such as class or package names.
- [EXTERNAL_DOWNLOADS]: The documentation references external utilities and services common in the Java ecosystem.
- Evidence: References the
codecov/codecov-actionfor CI integration and community tools likecover2cover.pyandxml2lcovfor report conversion. These are documented neutrally as standard tools for coverage aggregation.
Audit Metadata