Unit Test Coverage Helper

• Outcome: Pass
• Latest audit: Jul 29, 2026 · 7:51 AM UTC
• Version: 0.20260729.110214

Overview

This is a documentation-only unit-test workflow helper with no hidden execution, persistence, credential use, or data exfiltration behavior.

Before installing, be aware that the skill may activate on broad testing or quality-related requests. It appears safe for unit-test and coverage assistance, but users who want tight routing should prefer explicit invocation or narrow the trigger language.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger sentence is highly generic and can match ordinary user requests about testing or practical workflows, causing the skill to activate outside its intended scope. Overly broad activation increases the chance of prompt-routing errors, where this skill intercepts unrelated requests and influences outputs in ways the user did not explicitly intend.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The invocation guidance describes broad keywords and sample prompts without clear boundaries on when the skill should or should not activate. In agent systems, ambiguous routing can lead to unintended skill selection, which is a security and reliability concern because it expands the attack surface for prompt injection and misapplied behavior.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are broad enough to activate on many generic software/testing requests, which can cause the skill to run outside its intended scope. In an agent system, overbroad activation increases the chance of prompt-routing mistakes, unintended instruction precedence, and exposure to adversarial or irrelevant inputs that the skill was not designed to handle safely.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill description uses broad activation terms such as 'software-and-data', 'testing', and 'analysis', which can match many ordinary requests outside the stated unit-test-coverage purpose. This can cause the skill to be invoked unintentionally, creating prompt-scope confusion and increasing the chance that unrelated user tasks are handled by an ill-fitting workflow.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The example trigger begins with 'Help me', a generic phrase common in everyday conversation, which makes accidental activation much more likely. In a routing or orchestration system, this kind of overlap can misdirect user requests into this skill even when they are not about unit tests or coverage.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger description is broad and loosely bounded, covering generic software-testing terms and practical support requests. This can cause the skill to activate in situations where the user did not specifically want this workflow, leading to inappropriate context injection, reduced reliability, and possible interference with more relevant skills.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The example trigger phrases closely resemble ordinary user language and repeat broad request patterns like 'Help me' and 'I need a practical workflow'. Such examples increase the chance of accidental invocation from normal conversation, which can misroute tasks and override more suitable skill selection.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The default prompt contains very broad trigger language such as software, data, unit tests, coverage, testing, regression, workflow, artifact, checklist, analysis, and implementation support. This can cause the skill to activate for many ordinary developer requests beyond the user's clear intent, increasing the chance of prompt-scope confusion, unwanted context injection, or accidental delegation to this skill.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Implicit invocation is enabled without defined guardrails, while the skill's description and prompt are broad enough to match routine engineering conversations. In practice, this raises the likelihood of unintended activation and unnecessary exposure of conversation context to the skill, which can lead to incorrect task routing or prompt injection amplification if downstream skill behavior is unsafe.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The trigger sentence is written so broadly that it can match ordinary user phrasing rather than a narrow, explicit invocation of this skill. In an agent routing system, that increases the chance of accidental activation, causing the agent to apply this skill in unintended contexts and potentially override a more appropriate or safer workflow.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.