automation-coverage

Pass

Audited by Gen Agent Trust Hub on May 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes grep to extract test identifiers and git clone to retrieve external test suites when specified by the user. These commands are necessary for the skill's primary function of mapping tests to code.
  • [EXTERNAL_DOWNLOADS]: It downloads and runs several utilities from the npm registry using npx, including js-yaml and vendor-maintained tools like check-tests and @testomatio/reporter. These are used for configuration parsing and test synchronization.
  • [REMOTE_CODE_EXECUTION]: Dynamic execution occurs via npx to perform tasks like updating test IDs and running filtered test suites. The packages involved are either well-known utilities or directly provided by the skill author.
  • [PROMPT_INJECTION]: The skill ingests test files and source code to generate its coverage mapping. While this represents a surface for indirect prompt injection, the risk is minimal as the skill performs deterministic extraction of specific patterns rather than interpreting the content as instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
May 20, 2026, 02:50 PM
Security Audit — agent-trust-hub — automation-coverage