add-test-coverage
Warn
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates and executes code at runtime. It is instructed to 'Implement the tests' by adding or updating test files and then 'Run only the relevant tests'. This represents dynamic code generation and execution of scripts based on analyzed repository content.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing untrusted data from git diffs.
- Ingestion points: Output from git diff commands in SKILL.md.
- Boundary markers: None present to delimit diff content from agent instructions.
- Capability inventory: File system writes for test implementation and shell command execution for running tests as described in SKILL.md.
- Sanitization: No explicit sanitization or validation of the ingested diff data is performed.
- [SAFE]: The skill uses dynamic context injection to execute the 'date' and 'go version' commands. These are benign utility commands used to establish execution context and do not pose a security risk in this implementation.
Audit Metadata