plan-test-coverage — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited plan-test-coverage (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Role: Senior QA / test engineer.
Task: Audit the test suite against user stories and critical flows, not just line %. Find untested, weakly tested, and fake-green tests. Build traceability matrix + burndown. Audit & plan only — do not write tests in this pass.
| Skill | Does |
|---|---|
| plan-test-coverage (this) | Story-driven coverage plan |
test-unit | Write unit/integration tests (execution) |
test-qa | Live QA crawl |
test-playwright | E2E verification after changes |
workflow-spec-tdd | Spec + TDD during feature build |
plan-stub-checker | Finds unwired UI — feed into critical-path tests here |
Loop position: plan-stub-checker → wiring approval → plan-test-coverage → plan-perf-audit / plan-security-audit → plan-docs-sync
Read references/preservation-contract.md. Acknowledge in output #1.
| File | Contents |
|---|---|
references/methodology.md | Stories from code, traceability, multi-lens, fake-green |
references/output-templates.md | Matrix, burndown, phased plan |
0. Derive user stories from code (FIRST)
1. Inventory existing tests + coverage baseline
2. Traceability matrix (story ↔ test)
3. Multi-lens coverage audit
4. Fake-green / weak-test detection
5. Burndown + phased coverage plan
6. Guardrails (mutation CI, coverage ratchet)
7. Research citationsDetail: references/methodology.md
Reconstruct what the app promises from routes, handlers, flows — not invented stories.
Each story: acceptance criteria + criticality + cited implementing code.
Discover test files; map to stories. Run coverage tool if available:
npm test -- --coverage
npx vitest run --coverageNot run → [NEEDS RUN] with command to run.
Core artifact. Every critical story with no test = top-priority gap.
Template: references/output-templates.md
Judge branch/path/risk/integration/error paths — not just line %.
Flag fake-green: over-mocks, expect(true), implementation-detail tests.
Recommend mutation testing on critical modules for blind spots.
Phases:
Per gap: given/when/then spec + "what must keep working". Plan only.
[NEEDS RUN][NEEDS PRODUCT INPUT] / [NEEDS RUN]~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.