jest-coverage
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands through package managers (npm, yarn, pnpm, bun) and the local jest binary to generate coverage data. It also uses git commands to determine change scope.
- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it is explicitly instructed to read and follow commands and restrictions found in repository files such as
AGENTS.mdandCONTRIBUTING.mdwithout sanitization. - Ingestion points: Reads instructions from
AGENTS.md,CONTRIBUTING.md, and project configuration inpackage.json. - Boundary markers: The skill does not use specific delimiters or warnings to prevent instructions within these files from overriding its own logic.
- Capability inventory: Includes the ability to execute shell commands via package manager scripts and the
jestbinary, and the ability to read project files. - Sanitization: No sanitization or validation of instructions parsed from the repository files is mentioned or performed.
Audit Metadata