kover
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill includes a Python helper script (
scripts/inspect-project.py) to analyze project configuration. This script is restricted to reading local build files and uses regular expressions to extract configuration data without performing network operations, writing to the filesystem, or executing arbitrary code.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local build files (e.g.,build.gradle,pom.xml) via the inspection script. This represents a potential surface for indirect prompt injection if those files contain malicious instructions intended to be read by the AI agent.\n - Ingestion points:
scripts/inspect-project.pyreads file content from the local project directory to identify Kover settings.\n - Boundary markers: No explicit delimiters are specified in the instructions for separating ingested data from the agent's core logic.\n
- Capability inventory: The skill enables the agent to trigger standard Gradle and Maven coverage tasks (e.g.,
koverHtmlReport,koverVerify) and read official project documentation.\n - Sanitization: The script extracts data using specific regular expression patterns, which provides a basic layer of sanitization by ignoring unstructured or unexpected text content.\n- [SAFE]: All external references and downloads target official Kotlin/JetBrains documentation sites and well-known, trusted package registries like Maven Central.
Audit Metadata