Unit Test Coverage Helper

• Outcome: Pass
• Latest audit: Jul 24, 2026 · 4:57 PM UTC
• Version: 0.1.0

Overview

This skill is a simple guidance workflow for improving unit-test coverage and does not contain hidden execution, credential access, persistence, or data exfiltration behavior.

Before installing, be aware that this skill may activate for broad testing or quality-related requests. It appears safe for unit-test coverage help, but users who want precise routing may prefer narrower trigger wording or explicit invocation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger sentences are generic enough that normal user requests about unit tests or workflows could invoke the skill unintentionally. In an agent system, over-broad activation can route unrelated prompts into this skill, causing incorrect handling, confusion, or unintended execution paths; while not directly enabling code execution, it increases the attack surface for prompt-routing mistakes.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrases are broad enough to match common software-testing requests and generic workflow asks, which can cause the skill to activate when the user did not explicitly request it. Unintended invocation can steer the agent into an unnecessary or less appropriate workflow, increasing prompt-routing risk and reducing user control, even though the file itself does not contain direct code-execution behavior.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill description is broadly scoped to common software requests like testing, regression, and implementation support, which can cause the skill to activate in many ordinary engineering conversations beyond the narrowly intended use case. Overbroad activation increases the chance of misrouting user requests, causing the agent to apply this skill in inappropriate contexts and potentially override more suitable or safer domain-specific handling.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The keyword list contains highly generic terms such as 'software-and-data', 'testing', 'regression', and 'quality', which are common across many unrelated requests. This makes accidental invocation likely and weakens routing precision, creating opportunities for prompt-scope confusion or inappropriate automation behavior when the wrong skill is selected.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The example triggers use everyday language patterns like 'Help me' and 'I need a practical workflow' combined with a long requirement phrase, reinforcing a very permissive match style rather than a constrained activation boundary. In systems that rely on examples for routing behavior, such examples can cause the skill to be selected for loosely related requests and reduce trust in skill isolation.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill description is triggered by a very broad set of topics and user intents, which increases the chance it will activate outside its intended scope. Over-broad invocation can cause the agent to provide testing or code-change guidance in unrelated contexts, leading to confusing behavior, unintended file modifications, or policy bypass through misrouting rather than direct exploitation.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The keyword list includes generic terms like testing, regression, and quality without contextual constraints, making accidental or inappropriate triggering likely. In an agent system, such ambiguous routing can expose users to irrelevant actions or recommendations and may crowd out safer or more appropriate skills.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The default prompt contains a very broad trigger phrase covering common terms like software, unit tests, testing, regression, workflow, checklist, analysis, and implementation support. This increases the chance of unintended or overly frequent invocation in ordinary conversations, which can cause prompt hijacking of user intent, unnecessary tool activation, or routing sensitive development discussions into this skill without clear user intent.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrase uses broad, natural language that overlaps with many ordinary software requests, which can cause the skill to activate when the user did not explicitly intend to invoke it. In an agent system, unintended invocation can route user requests into the wrong workflow, leading to irrelevant outputs, hidden prompt influence, or accidental bypass of more appropriate skills and guardrails.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.