unit-testing-test-generate

The `CoverageAnalyzer.analyze_coverage` method accepts a `test_command` string and passes it directly to `subprocess.run`. An attacker or malicious prompt could inject arbitrary shell commands (e.g., '; rm -rf /') into this argument.

subprocess.run([test_command, '--coverage', '--json'], ...)

The skill includes a function that executes arbitrary shell commands provided as input to `analyze_coverage`. This creates a command injection vector if the `test_command` argument is not strictly sanitized, as it allows the execution of any system command with the privileges of the AI agent.

subprocess.run([test_command, '--coverage', '--json'], capture_output=True, text=True)

Skill executes commands, writes files, or accesses the network but declares no allowed-tools, so its tool surface cannot be reviewed or constrained.

Skill does not specify a license field. Specifying a license helps users understand usage terms.