# Coverage

> Show per-asset vuln-class coverage gaps for the active engagement so nothing in scope is skipped. Use when asked "coverage", "what haven't we tested", "test gaps", "are we thorough", or before calling an engagement done.

- **Type:** Skill
- **Install:** `agentstack add skill-encod3d-sec-torch-coverage`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Encod3d-Sec](https://agentstack.voostack.com/s/encod3d-sec)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Encod3d-Sec](https://github.com/Encod3d-Sec)
- **Source:** https://github.com/Encod3d-Sec/TORCH/tree/main/skills/workflow/coverage

## Install

```sh
agentstack add skill-encod3d-sec-torch-coverage
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Coverage

Systematic thoroughness: which phase items and applicable vuln classes have NOT been done.
Coverage now lives in the plan board (`targets//Approach.md`), not a separate file.

## Read the board
```
cat targets//Approach.md
python3 scripts/next_move.py      # ranks [gap] test moves from the 4a table + findings + Deadends
```
- Phase items still `[ ]` (todo) or `[~]` (doing) are the open work, in kill-chain order.
- The `### 4a` table is the per-asset coverage matrix: one row per (asset, vuln class); a row
  counts as tested when its `status` cell is `[x]`/done. Any applicable class with no done row
  on an in-scope asset is a gap. `next_move.py` surfaces these as `[gap]` moves.

## Then (model)
1. For each asset, the untested applicable classes ARE the to-do. Prioritise by impact + the
   `[gap]`/`[now]` moves from `next_move.py` (fingerprint-targeted).
2. Pull payloads from `wiki/payloads/` for each untested class (or `Skill(arsenal)`).
3. After testing a class on an asset, **add a `### 4a` row to `Approach.md`** with the class,
   the tool/payload, `status` `[x]`, and the `poc/` image (GATE 2). Otherwise the gap recurs.
4. A phase is done only when every applicable item is `[x]` or `[-]` (n/a) or `[!]` (deadend).

## Discipline
- Respect scope: out-of-scope assets are excluded by `next_move.py`.
- "Done" means tested, not necessarily clean - record findings separately as FINDs.
- Don't mark a row `[x]` without actually testing it and capturing a `poc/` image; this
  checklist only helps if honest.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Encod3d-Sec](https://github.com/Encod3d-Sec)
- **Source:** [Encod3d-Sec/TORCH](https://github.com/Encod3d-Sec/TORCH)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-encod3d-sec-torch-coverage
- Seller: https://agentstack.voostack.com/s/encod3d-sec
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.