coverage-analysis
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes
dotnet testto run project tests and collect coverage,dotnet tool installto set upReportGenerator, andgitfor repository structure detection. It also modifies test projects usingdotnet add packageto ensure necessary coverage collectors are present.\n- [EXTERNAL_DOWNLOADS]: Fetchesdotnet-reportgenerator-globaltooland NuGet packages includingcoverlet.collectorandMicrosoft.Testing.Extensions.CodeCoveragefrom the official NuGet registry, which is a well-known service. These components are required for the skill's core functionality.\n- [PROMPT_INJECTION]: The skill processes and summarizes Cobertura XML files generated during test execution to build a summary report for the agent, representing an indirect prompt injection surface.\n - Ingestion points:
coverage.cobertura.xmlparsed inCompute-CrapScores.ps1andExtract-MethodCoverage.ps1.\n - Boundary markers: Absent; data is interpolated into the final report template without specific ignore-instructions delimiters.\n
- Capability inventory: Shell command execution (
dotnet,git,reportgenerator) and local file system access across all scripts.\n - Sanitization: Data is parsed into structured XML objects before being formatted into the markdown report, reducing the risk of direct command execution via injection.
Audit Metadata