qa-test-code-coverage
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard system commands such as
grepfor pattern matching andgit clonefor retrieving test repositories into a localized cache. These operations are scoped to the project directory. - [EXTERNAL_DOWNLOADS]: The skill downloads and utilizes vendor-specific tools from the Testomat.io ecosystem, including
@testomatio/reporterandcheck-tests, as well as the well-knownjs-yamlpackage for configuration parsing. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill manages external test data by pulling it into a
.testeiya/directory and ensures this directory is added to.gitignoreto prevent accidental inclusion in the version control system. It does not access sensitive system paths or credentials. - [INDIRECT_PROMPT_INJECTION]: The skill processes test identifiers and titles from the project codebase. While this represents an ingestion surface for external content, the risk is mitigated by a bundled validation script (
scripts/check-coverage.mjs) that verifies the resulting coverage map against the actual file system.
Audit Metadata