testland/test-coverage-targeter
Builds a "what to test next" recommendation by combining a coverage report (LCOV / Cobertura / coverage.py JSON / Jest JSON / JaCoCo XML) with the PR's `git diff`, ranking uncovered branches by risk × cost - risk weighted by McCabe cyclomatic complexity and code-churn frequency, cost weighted by the unit-test pyramid layer (unit tests cheaper than integration than E2E). Also carries the coverage debt ledger: a weekly per-file drift report over N historical main runs flagging `falling` (line% slid >M pp from peak), `stale` (flat coverage + high churn), and `orphan` (lost last covering test) files, whose rows feed the same targeting. Emits a prioritized list with concrete file:line targets and the test layer recommended for each. Use when a team has the budget to write 5 - 10 new tests and needs help picking which uncovered code to target first instead of blindly chasing 100% coverage, or when specific modules are eroding silently while whole-repo coverage looks fine.
76
96%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Medium
Suggest reviewing before use
Security
1 medium severity finding. This skill can be installed but you should review these findings before use.
W009: Direct money access capability detected (payment gateways, crypto, banking).
What this means
The skill is specifically designed for direct financial operations, giving the agent the ability to move money or execute financial transactions — such as payment processing, cryptocurrency operations, banking integrations, or market order execution.
Why it was flagged
The skill explicitly references a payment gateway (Stripe) and recommends using a "Stripe sandbox" for integration tests, which is a specific payment API/tool mention that enables payment-path execution testing. Those references indicate the skill involves direct interaction with a payment provider (payment gateway).
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
SKILL.md describes runtime ingestion of a user-provided PR diff/coverage report and then parses “uncovered_branches” conditions/lines from those reports, meaning outsider-authored text sent through coverage-report or PR-related inputs is directly ingested for scoring and rendering.
Where we found it
coverage report (LCOV/Cobertura/Jest JSON/coverage.py JSON/JaCoCo XML)
content-type · 3 sites
The plugin parses coverage reports to extract uncovered branch conditions and renders them in markdown output, but these reports are machine-generated from the user's own CI pipeline and source code.
SKILL.md
48
| Coverage report | ✓ | LCOV / Cobertura / Jest JSON / coverage.py JSON / JaCoCo XML |
SKILL.md
57
```python
SKILL.md
70
Per language tool:
PR diff
content-type · 3 sites
The plugin reads a PR diff but only uses it to check file names (git diff --name-only) for PR-touch boosting, not to ingest or render outsider-authored content.
SKILL.md
51
| PR diff | opt | For PR-touch weighting (Step 4).
SKILL.md
135
If the PR diff (Step 1 optional input) changed a file, **boost its
SKILL.md
239
--diff <(git diff --name-only origin/${{ github.base_ref }}...HEAD) \
- Audited
- Security analysis