testland/ai-spec-coverage-mapper
Build-an-X workflow that uses an LLM to map existing tests to spec sections - given a spec doc + the test suite, the LLM identifies which tests cover which sections, surfaces uncovered sections (gap), and recommends specific tests to add. Output is a coverage matrix per spec ID. Scope is mapping tests that already exist and naming the gaps, not authoring tests for new acceptance criteria. Use when a spec doc and a test suite both exist but nobody can say which requirements are actually covered - before a release sign-off, an audit, or a decision about where to spend the next round of test effort.
69
87%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The skill’s required runtime workflow (`scripts/ai-coverage.py`) reads spec text and the existing test files provided by the user (spec_path and test_globs), so outsider-authored free text that is checked into the repo can be ingested and sent to the LLM without selecting a specific item first.
Where we found it
local repository files (spec_path, test_globs)
content-type · 3 sites
The plugin reads spec documents and test files from the user's own repository and sends their contents to the LLM, which is the ingestion path the scanner flagged.
SKILL.md
72
spec_text = read(spec_path)
SKILL.md
74
test_files = read_all(test_globs)
SKILL.md
89
{'role': 'user', 'content': f"Spec:\n{spec_text}\n\nTests:\n{test_files}"}
- Audited
- Security analysis