Unit Test Coverage Helper

• Outcome: Pass
• Latest audit: Jul 29, 2026 · 5:42 AM UTC
• Version: 0.20260729.110214

Overview

This skill is a plain unit-test coverage workflow with no executable code or hidden data access, though its activation language is broader than ideal.

Before installing, consider narrowing the trigger wording or disabling implicit invocation if your environment has many overlapping developer skills. The skill itself appears safe for normal use as a local unit-test and coverage-assistance workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger sentence is extremely broad and can match many ordinary requests about testing or software help, which increases the chance that this skill is invoked outside its intended scope. Over-broad activation can cause prompt hijacking at the routing layer, displace more appropriate skills, and create unsafe or misleading assistance when the user did not actually request coverage-focused workflows.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The invocation guidance lists keywords and trigger phrases but does not define boundaries for when the skill should not run, making routing ambiguous. In agent ecosystems, this ambiguity is dangerous because it can cause accidental auto-selection on common terms like 'testing' or 'workflow,' increasing cross-skill interference and the chance of irrelevant or unsafe execution paths.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases are broad enough that the skill may activate for generic testing or software requests without clear user intent, causing the agent to apply this workflow in unintended contexts. In an agent ecosystem, ambiguous routing can lead to inappropriate data handling, irrelevant actions, or overreach into repositories and codebases the user did not explicitly ask to analyze for test coverage work.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The skill description and trigger criteria are broad enough to match many ordinary software requests, which can cause the skill to activate outside its intended scope. Over-broad routing is dangerous because it can override more appropriate skills, increase prompt-surface exposure, and lead to incorrect or lower-safety behavior in unrelated tasks.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The example trigger phrases use everyday language that is so general it can encourage invocation for loosely related requests. This makes accidental activation more likely and weakens routing precision, especially in environments with multiple overlapping skills.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger description is broad and loosely bounded, covering generic software-and-data and testing-related requests without strong disambiguation. This can cause the skill to activate in situations it was not specifically designed for, leading to irrelevant guidance, unintended workflow injection, or overshadowing more appropriate skills in mixed-security or code-modification contexts.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The keyword list includes highly generic terms such as testing, regression, and quality, which are common across many unrelated developer tasks. Overbroad keywords increase the chance of accidental invocation, causing prompt-routing errors and exposing users to instructions or code changes not tailored to the actual request.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The default prompt uses very generic terms such as 'help me' and broad testing-related language, which can overlap with ordinary user requests and cause unintended skill invocation. Because implicit invocation is enabled, this increases the chance the skill activates without clear user intent, creating prompt-routing confusion and potentially exposing the user to behavior they did not explicitly request.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger sentence is so broad that it can match ordinary user language and cause the skill to activate outside its intended scope. In an agent system, overbroad activation can route unrelated requests into this skill, creating prompt-scope confusion, inappropriate data handling, or unintended assistance on tasks the skill was not meant to perform.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.