coverage-gate
Ensures 80% minimum endpoint coverage before proceeding to Phase 2 in security audits.
Install
mkdir -p .claude/skills/coverage-gate && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/12013" && unzip -o skill.zip -d .claude/skills/coverage-gate && rm skill.zipInstalls to .claude/skills/coverage-gate
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Check endpoint_map.md coverage at Phase 1→2 transition. Blocks Phase 2 if below 80%. Matches "coverage check", "endpoint coverage", "Phase 2 gateKey capabilities
- →Check endpoint_map.md coverage
- →Block Phase 2 if coverage is below 80%
- →Output a list of untested endpoints on failure
- →Require 100% coverage for targets with fewer than 10 endpoints
- →Report coverage statistics
How it works
This skill runs a Python script to check the coverage of `endpoint_map.md` for a given target directory. It blocks progression to Phase 2 if coverage is below 80% (or 100% for small targets) and lists any untested endpoints.
Inputs & outputs
When to use coverage-gate
- →Validate coverage before next phase
- →Block progression with insufficient tests
- →List missing endpoint coverage
About this skill
Endpoint Coverage Gate
CRITICAL RULES (NEVER VIOLATE)
- FAIL → Phase 2 is BLOCKED — no Phase 2 spawn without coverage gate pass
- No premature "analysis complete" declarations — must verify numbers against endpoint_map.md
Checks endpoint_map.md coverage at Phase 1→2 transition. Lesson: NAMUHX had 40% coverage at Phase 2 entry; the real IDOR was in the untested 60%.
Input
$ARGUMENTS: target directory (e.g.,targets/keeper)
Procedure
Step 1: Run bb_preflight.py coverage-check
!python3 /home/rootk1m/01_CYAI_Lab/01_Projects/Terminator/tools/bb_preflight.py coverage-check "$ARGUMENTS" 2>&1
Step 2: Parse Result
| Result | Condition | Action |
|---|---|---|
| PASS | coverage >= 80% | Phase 2 proceed |
| FAIL | coverage < 80% | Phase 2 BLOCKED. Output UNTESTED endpoint list |
| ERROR | endpoint_map.md missing | Scout must generate it. Phase 2 blocked |
Step 3: On FAIL — List UNTESTED Endpoints
!grep -i "UNTESTED" "$ARGUMENTS/endpoint_map.md" 2>/dev/null || echo "endpoint_map.md not found"
Step 4: Small Target Exception
- Total endpoints < 10 → 100% coverage required (not 80%)
- Reason: 1-2 untested endpoints on small targets = critical attack surface gap
Step 5: Output
[COVERAGE-GATE] Target: <target>
[COVERAGE-GATE] Total endpoints: N
[COVERAGE-GATE] Tested: N (VULN=X, SAFE=Y, TESTED=Z)
[COVERAGE-GATE] Untested: N
[COVERAGE-GATE] Coverage: XX.X%
[COVERAGE-GATE] Threshold: 80% (or 100% for <10 endpoints)
[COVERAGE-GATE] Result: PASS / FAIL
[COVERAGE-GATE] Action: <"Phase 2 proceed" or "Additional analyst/exploiter round needed — UNTESTED list attached">
REMINDER: FAIL = Phase 2 blocked. Spawn additional analyst/exploiter rounds targeting UNTESTED endpoints.
When not to use it
- →When the user wants to proceed to Phase 2 with less than 80% coverage (or 100% for small targets)
- →When `endpoint_map.md` is missing and cannot be generated
- →When the user wants to declare "analysis complete" prematurely
Limitations
- →Phase 2 is BLOCKED if coverage is below 80%
- →100% coverage required for total endpoints less than 10
- →Phase 2 is blocked if `endpoint_map.md` is missing
How it compares
This skill automates a critical coverage gate, preventing advancement to the next phase with insufficient testing, which is more rigorous than manual checks.
Compared to similar skills
coverage-gate side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| coverage-gate (this skill) | 0 | 5mo | Review | Intermediate |
| windows-ui-automation | 17 | 8mo | Review | Advanced |
| qa-tester | 29 | 9mo | No flags | Intermediate |
| reviewing-code | 21 | 8mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
windows-ui-automation
martinholovsky
Expert in Windows UI Automation (UIA) and Win32 APIs for desktop automation. Specializes in accessible, secure automation of Windows applications including element discovery, input simulation, and process interaction. HIGH-RISK skill requiring strict security controls for system access.
qa-tester
svilupp
Browser automation QA testing skill. Systematically tests web applications for functionality, security, and usability issues. Reports findings by severity (CRITICAL/HIGH/MEDIUM/LOW) with immediate alerts for critical failures.
reviewing-code
CaptainCrouton89
Systematically evaluate code changes for security, correctness, performance, and spec alignment. Use when reviewing PRs, assessing code quality, or verifying implementation against requirements.
web3-testing
wshobson
Test smart contracts comprehensively using Hardhat and Foundry with unit tests, integration tests, and mainnet forking. Use when testing Solidity contracts, setting up blockchain test suites, or validating DeFi protocols.
zod-4
prowler-cloud
Zod 4 schema validation patterns. Trigger: When creating or updating Zod v4 schemas for validation/parsing (forms, request payloads, adapters), including v3 -> v4 migration patterns.
pr-review
pytorch
Review PyTorch pull requests for code quality, test coverage, security, and backward compatibility. Use when reviewing PRs, when asked to review code changes, or when the user mentions "review PR", "code review", or "check this PR".