Unit Test Coverage Helper

• Outcome: Pass
• Latest audit: Jul 29, 2026 · 3:47 AM UTC
• Version: 0.20260729.110214

Overview

This is a simple unit-test coverage workflow skill with no executable payload, credentials access, persistence, or hidden data handling, though its activation wording is broader than ideal.

This skill is reasonable to install for help adding or improving unit tests. Users who want stricter routing should invoke it explicitly or tighten/disable implicit invocation because terms like testing, regression, and quality may match broader development conversations.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger sentence is broad enough to match ordinary user requests for general testing help, which can cause the skill to activate outside a narrowly intended scope. Over-broad activation is dangerous because it can hijack unrelated conversations, inject irrelevant instructions, or override more appropriate skills in routine software-assistance contexts.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The invocation wording uses ambiguous natural-language phrasing that does not clearly define when this skill should be selected. This increases the chance of accidental invocation from common help-seeking language, expanding the skill's effective permissions and making routing behavior less predictable.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrases are broad enough to match many ordinary requests about testing, workflows, or software support, which can cause the skill to activate outside the user's clear intent. In an agent environment, this increases the chance of inappropriate routing or over-invocation of the skill, potentially leading to confusing behavior, unnecessary file/code analysis, or unintended actions based on mismatched context.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill description uses broad trigger language such as 'software-and-data,' 'testing,' and 'analysis,' which can match many unrelated user requests. This can cause unintended activation, leading the agent to apply this skill in contexts where it is not appropriate and potentially produce irrelevant or misleading outputs.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The keyword list contains vague terms like 'testing,' 'regression,' and 'quality,' which are common across many software conversations and are not specific enough for reliable routing. Over-broad keywords increase the chance of false activation and misrouting, which can interfere with expected agent behavior.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The example trigger starts with the everyday phrase 'Help me,' which is extremely common in normal conversation and can collide with unrelated prompts. This makes accidental invocation more likely, especially when paired with the already broad requirement text repeated in the example.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger keywords include broad everyday terms such as "testing" and "quality", which can overlap with ordinary user requests outside the intended unit-test-coverage scope. This can cause the skill to activate unexpectedly, leading to irrelevant guidance, context hijacking, or suppression of a better-matched skill, though it does not directly enable code execution or data exfiltration.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The example trigger phrases use generic help-seeking language like "Help me" and "I need a practical workflow", which are common across many unrelated tasks. In a routing system, such ambiguous examples can broaden matching behavior and increase accidental invocation of this skill in contexts where testing assistance was not actually requested.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The default prompt contains very broad trigger language such as 'software-and-data, unit tests, test coverage, testing, regression' that overlaps with many ordinary developer conversations. In combination with agent routing, this can cause the skill to be invoked in contexts the user did not clearly intend, increasing the chance of prompt/context leakage, irrelevant actions, or unsafe overreach.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Enabling implicit invocation without clear trigger constraints or exclusion conditions allows the skill to activate automatically based on ambiguous user language. This expands the attack surface for misrouting and unintended handling of user input, especially because the skill's domain is broad and commonly discussed in normal software engineering requests.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger sentence is so generic that it can match ordinary user requests about testing or practical help, causing the skill to activate outside its intended scope. Overly broad activation increases the chance of misrouting user intent, unexpected prompt injection surface expansion, and accidental interference with other more appropriate skills.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.