Unit Test Coverage Helper

• Outcome: Pass
• Latest audit: Jul 29, 2026 · 5:51 AM UTC
• Version: 0.20260729.110214

Overview

This skill is a documented unit-test coverage helper with no executable code, persistence, credential use, or hidden data flow, though its auto-invocation wording is broader than ideal.

This skill is reasonable to install if you want help with unit tests and coverage. Be aware that it may activate on broad testing or quality requests, so review whether its workflow fits the task before accepting code changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrases are extremely generic and can activate on broad requests about testing, workflows, or implementation support, causing the skill to be selected outside its intended scope. Over-broad activation increases the chance of prompt/skill routing confusion, which can lead to irrelevant or unintended instructions being injected into unrelated tasks.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are broad and map to common software-testing terms such as 'testing', 'regression', and 'quality', which can cause the skill to activate in situations beyond its intended scope. Over-broad activation increases the chance of unintended invocation, context hijacking, or routing users into this skill when another skill or a safer default behavior would be more appropriate.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger keyword list is broad and uses everyday terms such as 'testing' and 'quality', which can cause the skill to activate in contexts far outside its intended scope. Over-broad activation increases the chance of unintended routing, prompt collisions, and inappropriate disclosure or modification guidance being applied to unrelated user requests.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The example trigger phrases are written in highly generic language ('Help me', 'I need a practical workflow') and effectively teach invocation on vague requests without enforcing domain-specific qualifiers. This makes accidental or overly permissive activation more likely, which can degrade safety by routing unrelated requests into this skill's workflow.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list includes broad generic terms such as "testing" and "quality", which can cause the skill to activate for many unrelated requests. In an agent system, over-broad activation can route user prompts into an inappropriate workflow, producing irrelevant code changes or analysis and increasing the attack surface for prompt confusion or unintended tool use.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The description says the skill should be used when users ask for broad categories like software-and-data, testing, or implementation support, which makes activation criteria ambiguous. This ambiguity can cause accidental invocation outside the intended unit-test-coverage context, leading to misrouting, low-quality outputs, or unsafe overlap with other skills that should handle the request.

Vague Triggers

High

• Confidence: 93% confidence
• Finding: The default prompt contains a very broad activation phrase tied to common software-development terms like unit tests, test coverage, testing, regression, workflow, checklist, analysis, and implementation support. In combination with agent routing, this can cause the skill to be invoked for many ordinary requests outside a narrowly intended scope, increasing the chance of unintended context capture, overreach, or confusing tool use.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: Implicit invocation is enabled even though the skill's trigger scope is broad and overlaps with everyday engineering language. This creates a realistic risk that the agent will auto-route user conversations into this skill without clear consent or precision, potentially exposing unrelated code context to the skill and causing unintended actions or recommendations.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger sentence is overly broad and can match ordinary user phrasing rather than an explicit request to invoke this skill. That can cause unintended activation in unrelated conversations, routing users into a testing workflow they did not ask for and potentially overshadowing more appropriate skills or system behavior.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.