Borrowing it
Nothing to install: this file belongs to petarzarkov/dunx. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/petarzarkov/dunx/main/.claude/skills/coverage-report/SKILL.mdgit clone --depth 1 https://github.com/petarzarkov/dunxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/petarzarkov/dunx/coverage-report)<a href="https://agentmods.dev/skills/petarzarkov/dunx/coverage-report"><img src="https://agentmods.dev/badge/skills/petarzarkov/dunx/coverage-report.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.00785 |
| Opus 5 | $0.00028 | $0.00392 |
| Sonnet 5 | $0.00011 | $0.00157 |
| Haiku 4.5 | $0.00006 | $0.00078 |
Grade A, and why
coverage-report scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/coverage-report
bun run test:cov # bun test --coverage from the ROOT, then gen:cov
bun run docs:build # the site is what carries the report and the badges
bun run gen:readme # only if the package set changed
Order matters. test:cov must run once from the repo root so every package
lands in a single coverage/lcov.info; running it per package overwrites that
file with one package's data.
scripts/coverage-report.ts then turns the lcov into two things, both inside
internal/docs - the site is the Pages root, coverage is a page in it:
internal/docs/src/generated/coverage.json- the model the Coverage page renders (per-package breakdown, uncovered line ranges, packages with no tests)internal/docs/public/badges/coverage.svgplus acoverage-<package>.svgeach, which the build copies verbatim to/badges/in the built site
Zero dependencies. It writes no HTML of its own any more; bun run docs:build
has to run afterwards for either output to reach the deployed site. CI does that
in the Build the documentation site step, which sits after test:cov for
exactly this reason.
Badges live in the root README's generated Packages table, in the Coverage
column added by scripts/update-readme.ts - not in per-package READMEs. A new
package picks one up automatically on the next gen:cov + gen:readme.
Lines and functions only. Bun emits no branch records, so there is no branch column to add.
Diagnosing
| Symptom | Cause |
|---|---|
| Every badge 404s on GitHub | Pages is on the default Deploy from a branch source, so GitHub serves a Jekyll render of the README. It must be set to GitHub Actions in repo settings. |
| One package's number is way off | A sibling import resolved to that sibling's dist/ and got counted alongside its src/. bunfig.toml sets coveragePathIgnorePatterns = ["**/dist/**"] - check it holds. |
Package shows grey no tests |
Correct, not a bug - no test files. Grey beats a misleading 0%. |
| Numbers stale after adding tests | gen:cov ran without a fresh test:cov, so it reparsed the old lcov. |
| New package missing from the table | gen:readme not run after gen:cov. |
| Coverage page says "no coverage data" | The site was built before gen:cov ran. bun run test:cov && bun run docs:build. |
| Badges 404 but the site loads | They are at /badges/coverage-<pkg>.svg now, not the Pages root. Check scripts/update-readme.ts's DOCS_SITE. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · -2 tokens per session c78e4ff108bb
- 7d ago First seen · 53 lines · 57 tokens per session scan A 873d55dfc576
coverage-report is a skill published in the GitHub repository petarzarkov/dunx (21 stars, last pushed yesterday), licensed MIT. It adds 55 tokens to every session and 785 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
nestjs
Use when building or structuring a NestJS backend — feature modules, providers and DI wiring, provider scopes and request-lifecycle order, where to bind guards/pipes/interceptors/filters, and testing with Test.createTestingModule. NOT a bare Express/Fastify service with no DI (that is nodejs), NOT framework-agnostic…
terraform-test
Comprehensive guide for writing and running Terraform tests. Use when creating test files (.tftest.hcl), writing test scenarios with run blocks, validating infrastructure behavior with assertions, mocking providers and data sources, testing module outputs and resource configurations, or troubleshooting Terraform test…
adversarial-reviewer
Adversarial code review that assumes bugs exist and hunts for them. Use when asked to review code, find bugs, audit for correctness, stress-test a PR, or when someone says "tear this apart" or "what's wrong with this". Give no benefit of the doubt — every line is guilty until proven innocent.
repro-api
Reproduce an EmDash bug below the browser layer -- REST handlers, CLI, MCP, migrations, schema registry, or build tooling. No browser. Prefer a failing vitest test in the affected package, run in an attached container.
om-troubleshooter
Diagnose and fix standalone Open Mercato bugs across scope, commands, locking, fields, generated registries, UI hydration, cache/search, bootstraps, queues, and providers. Use for "fix bug", "why does this fail", "regression", "debug", "napraw błąd", or a failing test.
verify-bug
Post-merge UAT verification workflow. Walks JIRA reproduce steps, performs comparative audits (Before/After), attaches evidence to JIRA, and transitions status on PASS.