testland/lcov-analysis
Parses both mainstream coverage interchange formats: LCOV `.info` text files (produced by gcov, llvm-cov, Coverage.py via `py2lcov`, JaCoCo via `xml2lcov`, Devel::Cover, Jest via `lcov` reporter, NYC, and most others) and Cobertura XML (coverage-04.dtd - emitted by JaCoCo, coverage.py `--xml`, Jest's `cobertura` reporter, coverlet, gocover-cobertura; full parser in references/cobertura.md). Extracts per-file line / function / branch metrics from the canonical record keywords (TN/SF/FN/FNDA/FNF/FNH/BRDA/BRF/BRH/DA/LH/LF), computes the diff vs a baseline, and emits per-file gating verdicts. Use for PR coverage gates that don't depend on a specific language runtime, whichever of the two formats the CI emits.
74
93%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The runtime workflow parses coverage inputs from files such as `coverage/lcov.info` and `baseline/lcov.info` (and `coverage.xml` in the Cobertura CI example), where those text artifacts are produced by the PR’s CI and thus can include outsider-authored free text in `.info`/XML reports.
Where we found it
LCOV .info coverage report files
content-type · 5 sites
The plugin parses LCOV .info text files produced by CI, which contain file paths (SF:), function names (FN:/FNDA:), and test names (TN:) that a PR author can influence, creating an indirect prompt-injection vector when the parsed data is used in gating verdicts or PR comments.
SKILL.md
95
def parse_lcov(path):
98
with open(path) as f:
references/format-diff-and-ci.md
94
python scripts/parse_lcov.py coverage/lcov.info > current.json
95
python scripts/parse_lcov.py baseline/lcov.info > baseline.json
103
path: coverage/lcov.info
Cobertura XML coverage report files
content-type · 5 sites
The plugin parses Cobertura XML files produced by CI, which contain package names, class names, filenames, and method names that a PR author can influence, creating an indirect prompt-injection vector when the parsed data is used in gating verdicts or PR comments.
references/cobertura.md
103
def parse_cobertura(path):
references/cobertura.md
104
root = ET.parse(path).getroot()
references/cobertura.md
192
cat target/site/jacoco/cobertura.xml > coverage.xml
references/cobertura.md
197
coverage xml -o coverage.xml
references/cobertura.md
203
- run: python scripts/parse_cobertura.py coverage.xml > current.json
- Audited
- Security analysis