literary-criticBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

git clone https://github.com/nuncaeslupus/literary-critic.git && cd literary-critic && claude
# then say: "I want to use literary-critic for my novel"

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: coverage-gaps
description: Ranks the highest-value missing tests from coverage.py's coverage.json; cheaper than mutmut-report. Use when the user asks what tests are missing or where coverage gaps are. Not for running the suite or non-Python coverage.
argument-hint: "--input coverage.json --limit N"
user-invocable: true
metadata:
  section: python
---

# coverage-gaps

Turns an existing coverage.py report into a ranked list of the tests worth
writing next.

CANARY: coverage-gaps-loaded-2026-06-04-ea39c2b5-b32fe2b1b5ae5e96

## When to load

Load when the question is which coverage gaps to fill first. This is the cheap,
line-level pass; once line coverage is healthy and the question is whether
tests assert behaviour, use the `mutmut-report` skill.

## Step 1 — Ensure a JSON report exists

The script reads coverage.py's JSON export, not the `.coverage` database, and
exits 2 without it. Regenerate it after a refactor, since old line numbers
drift from the source.

```bash
coverage json                                    # after `coverage run -m pytest`
pytest --cov=PKG --cov-branch --cov-report=json  # or in one shot, with branches
```

## Step 2 — Rank the gaps

```bash
python3 "${CLAUDE_SKILL_DIR}/scripts/analyze_coverage.py" --input coverage.json --limit 20
```

The JSON carries `total_percent_covered`, `files_with_gaps`, and a ranked `gaps`
list with `missing_count`, `percent_covered`, `missing_branches` (populated only
with branch coverage), `largest_run` and `missing_runs` (inclusive line ranges).

## Step 3 — Propose tests

Open the source at each `missing_runs` range before recommending, because a long
run can be a generated block, a `__repr__` or an `if TYPE_CHECKING:` island;
rank by what the code does, not by line count. Then report:

1. The 2–3 tests worth writing now: which function, which input, which branch.
2. Branch gaps in otherwise well-covered files, from `missing_branches`.
3. Low-value gaps (scattered defensive `raise` or logging lines) that can wait
   or take `# pragma: no cover`.

Covered means executed, not asserted, so treat this ranking as the floor.

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (5 observation(s))

Network

declared (10 observation(s))

Shell

declared (1 observation(s))

Dependencies

pinned

Secrets in source

none-found

Findings (17)

| `access:secrets` | machine-local credentials | naming it at `/queue-next` |

return importlib.import_module(f"{__name__}.{name}")

text = re.sub("[]", "", text)

.coderabbit.yaml

.pre-commit-config.yaml

.arsenal-manifest

.bundle-version

payload-template.md

return "doc-" + hashlib.sha1(text.encode("utf-8")).hexdigest()[:8]  # a name, not a signature

return "doc-" + hashlib.sha1(text.encode("utf-8")).hexdigest()[:8]  # a name, not a signature

out[sc["id"]] = hashlib.sha1(body.encode("utf-8")).hexdigest()[:16]

span.sha1 = hashlib.sha1(body.encode("utf-8")).hexdigest()

and hashlib.sha1(body.encode("utf-8")).hexdigest() == span.sha1

for slug in ("../../x", "/tmp/x"):

- Writer-facing report (S1), session flow and journal (S2), Claude packaging and local tool server (S3), editing real files, docx-fixer integration.

<li>Writer-facing report (S1), session flow and journal (S2), Claude packaging and local tool server (S3), editing real files, docx-fixer integration.</li>

- Writer-facing report (S1), session flow and journal (S2), Claude packaging and local tool server (S3), editing real files, docx-fixer integration.

Gates applied: no_behavioural_pass.