coverage-analysis — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited coverage-analysis (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 7 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 9 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Explain what .NET coverage evidence proves, reconcile target arithmetic, and identify the code blocking progress. Add complexity/CRAP ranking only when the user explicitly asks for risk hotspots, CRAP, priorities by risk, or refactoring safety.
Use this skill for interpreting supplied .NET line/branch/condition evidence, coverage gaps and plateaus, target arithmetic, or explicit project-wide coverage-backed risk analysis.
crap-score skill insteadfind-untested-sourcestest-gap-analysistest-taggingrun-tests; use native tooling for non-.NET coverage collection or analysis. Interpreting .NET line/branch gaps remains in scope here| Input | Required | Default | Description |
|---|---|---|---|
| Project/solution path | No | Current directory | Path to the .NET solution or project |
| Line coverage threshold | No | 80% | Minimum acceptable line coverage |
| Branch coverage threshold | No | 70% | Minimum acceptable branch coverage |
| Existing Cobertura path | No | Discover only if not supplied | Preferred input; never rerun tests when usable |
| CRAP threshold | No | 30 | Used only for explicit risk/CRAP requests |
| Hotspot count | No | 3 | Explicit risk requests only; cap at 10 unless the user asks for more |
Discover optional inputs from the workspace. Do not ask for a project path when the current directory or a supplied report is sufficient.
| User intent | Required work | Do not do |
|---|---|---|
| Explain a supplied excerpt, condition, or summary | Answer directly from the supplied evidence | Tools, CRAP, discovery, report files |
| Interpret a supplied Cobertura path or diagnose a plateau | Read that report, reconcile totals, name all material gaps, answer directly | Rerun tests, install tools, compute CRAP, or generate files unless explicitly requested |
| Rank risk hotspots, compute project-wide CRAP, or assess refactoring safety | Use the supplied/existing report, read references/guidelines.md, and compute CRAP before ranking | Coverage-only ranking or a full report template unless requested |
| Analyze coverage when no report exists | Invoke run-tests to collect coverage with the repository-compatible runner, then analyze the generated report | Choose or execute a test command independently; CRAP unless risk was requested |
| Produce a full markdown/HTML/CSV report | First deliver the direct answer; then read references/output-format.md or references/report-generation.md | Report generation before the answer |
Words such as analyze coverage, what is blocking coverage, or why is coverage stuck do not by themselves request CRAP. Explicit signals include risk hotspot, CRAP, complexity-weighted priority, safe to refactor, or an equivalent request to combine complexity with coverage.
When the user supplies a coverage excerpt, summary, or valid Cobertura path:
dotnet test, install ReportGenerator, add a coverage package, orread references/setup-discovery.md or references/report-generation.md.
coverage-analysis.md or create a report directory unless the userrequested a saved/full report.
answer. For explicit project-wide risk requests, use the bundled scripts as described in references/guidelines.md.
A failed read/view operation is not proof that a named path does not exist. Classify the failure, then make one targeted existence probe and use a normalized path or alternate reader only for confirmed tool availability, transport, or path-normalization failures and only after verifying the canonical path remains inside the workspace. Stop on content-exclusion, permission/policy, workspace-boundary, or unknown failures. Report a missing path only when the independent probe also fails; do not broaden the search or substitute another artifact.
Use this path only when no usable coverage evidence exists and the user asked for analysis that requires it.
references/setup-discovery.md.run-tests for repository overlay, platform, runner,and command selection, and have it collect Cobertura once per entry point.
explicitly requested.
When the workspace contains the project/test manifests needed by this path, perform discovery directly and delegate collection to run-tests. Do not ask the user to attach files or pre-run coverage that the current workspace lets you inspect and generate.
Do not modify production code. Any incidental test-project change needed for collection is owned by run-tests; include that change and its revert command in the final analysis.
The automatic collection path is for SDK-style projects. For classic non-SDK or packages.config projects, use only a repository-owned coverage command. If none exists, stop and request Cobertura XML. Never migrate the project, inject an SDK-style provider, create a wrapper project, or report substitute coverage from another assembly.
condition-coverage="50% (1/2)" proves one reported outcome ran, but not whichone. Recommend forcing the opposite outcome. Without source, never invent likely predicates or claim whether true or false is missing. State that compound predicates need independently exercised operands and short-circuit combinations when applicable; do not infer the exact combinations without source or fuller XML.
T, required covered lines are ceiling(valid lines × T).
valid lines`. State assumptions such as fully covering a method.
total and at least one concrete sufficient combination of supplied members or line gains. If no supplied combination is sufficient, say so.
valid total; saying only "combine it with another member" is incomplete.
omit class-level lines, so do not sum method counts as project truth.
its distinct uncovered lines exactly reconcile with the project total and no other below-threshold member remains.
proportional: lead with the blockers, summarize the remainder in one sentence or a compact table.
Answer the user's question in the first 2–4 sentences.
priority. No dashboard.
blocking members, reconciled target impact, and 1–3 recommendations. Use at most one compact table.
complexity/coverage/CRAP values, remaining flagged count, and 1–3 priorities. Exclude fully covered low-risk methods from the hotspot table. Never exceed 10 rows unless the user requests a larger count. For refactoring safety, rank risky methods by CRAP rather than raw coverage alone, then name comparatively safe well-covered methods separately.
references/output-format.md. Save thereport only then.
Report only artifacts that exist. Do not announce inaccessible output paths or failed optional file writes when no file was requested.
HTML/CSV/markdown files are not part of normal analysis. Generate them only when the user explicitly requests report files or a CI artifact.
references/output-format.md and save it.references/report-generation.md. Do not installReportGenerator before the direct answer, and do not retry a failed install.
references/guidelines.md.the full below-threshold set first.
substitute coverage.
function names against source before presenting them as user-authored members.
nonzero build failures stop the collection path.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.