automation-coverage
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
grepto extract test identifiers andgit cloneto retrieve external test suites when specified by the user. These commands are necessary for the skill's primary function of mapping tests to code. - [EXTERNAL_DOWNLOADS]: It downloads and runs several utilities from the npm registry using
npx, includingjs-yamland vendor-maintained tools likecheck-testsand@testomatio/reporter. These are used for configuration parsing and test synchronization. - [REMOTE_CODE_EXECUTION]: Dynamic execution occurs via
npxto perform tasks like updating test IDs and running filtered test suites. The packages involved are either well-known utilities or directly provided by the skill author. - [PROMPT_INJECTION]: The skill ingests test files and source code to generate its coverage mapping. While this represents a surface for indirect prompt injection, the risk is minimal as the skill performs deterministic extraction of specific patterns rather than interpreting the content as instructions.
Audit Metadata