qa-manual-tests-to-code-coverage
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches manual test cases from the vendor's platform using
npx check-tests pulland utilizes@testomatio/reporterfrom the npm registry. - [COMMAND_EXECUTION]: Executes shell commands including
grepfor data extraction andnpxto run vendor-provided CLI tools for reporting and synchronization. - [COMMAND_EXECUTION]: Runs a bundled validation script
scripts/check-coverage.mjsvianodeto verify the generated coverage mapping. - [PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection (Category 8) as it processes external, potentially untrusted data.
- Ingestion points: Processes manual test markdown files (
.test.md) and the project's source code files (Step 1, Step 2, Step 3). - Boundary markers: Absent; the skill does not define specific delimiters or instructions to ignore potential commands embedded within the test cases or source code.
- Capability inventory: The agent has the ability to execute shell commands (
grep,npx,node) and write files to the repository (coverage.manual.yml,.gitignore). - Sanitization: Absent; content from the analyzed files is read and interpreted by the agent without prior filtering or sanitization.
Audit Metadata