qa-test-code-coverage

Pass

Audited by Gen Agent Trust Hub on Aug 12, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes standard system commands such as grep for pattern matching and git clone for retrieving test repositories into a localized cache. These operations are scoped to the project directory.
  • [EXTERNAL_DOWNLOADS]: The skill downloads and utilizes vendor-specific tools from the Testomat.io ecosystem, including @testomatio/reporter and check-tests, as well as the well-known js-yaml package for configuration parsing.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill manages external test data by pulling it into a .testeiya/ directory and ensures this directory is added to .gitignore to prevent accidental inclusion in the version control system. It does not access sensitive system paths or credentials.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes test identifiers and titles from the project codebase. While this represents an ingestion surface for external content, the risk is mitigated by a bundled validation script (scripts/check-coverage.mjs) that verifies the resulting coverage map against the actual file system.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 12, 2026, 04:46 PM
Security Audit — agent-trust-hub — qa-test-code-coverage