Not in the top 1,000 by GitHub stars
supercorp-ai/supercov
Coverage, security and code quality for coding agents
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
plugins/supercov/skills/supercov/SKILL.md
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → b1aafa07ce6b
No earlier version was observed for comparison.
plugins/supercov/skills/supercov-security/SKILL.md
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → b1aafa07ce6b
No earlier version was observed for comparison.
Verified commit b1aafa07ce6be3a8697d1a5a7697e5ecb19b014d
git clone --filter=blob:none --no-checkout https://github.com/supercorp-ai/supercov.git .hotskills/supercorp-ai-supercov && git -C .hotskills/supercorp-ai-supercov checkout --detach b1aafa07ce6be3a8697d1a5a7697e5ecb19b014d
# Copy each selected skill directory from .hotskills/supercorp-ai-supercov into .claude/skills/<skill-name>/Heat
1.8- Star growth, last 7 daysNot available
- Star growth, last 24 hoursNot available
- Rank movement, last 7 daysNot available
- Commits, last 30 daysNot available
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekNot available
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
30-day change not yet available: not enough history.
Individual skills in this repository
- supercov
plugins/supercov/skills/supercov - supercov-security
plugins/supercov/skills/supercov-security
How it works
supercov
When your agent uses it
Measures test coverage and code quality in a repository with the supercov CLI, and turns what it finds into small, focused tests or fixes. Use when the user asks to add or improve tests, find untested code or raise coverage, or find what to refactor. Works with JavaScript, TypeScript, Python, Ruby, Rust, Go, Java and Kotlin projects.
What it loads into context
Frontmatter
85 tokensAlways available to the agent
SKILL.md
399 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Add a test
- Quality
Files
../../../../.claude-plugin/marketplace.jsonasset330 bytes../../.claude-plugin/plugin.jsonasset406 bytesSKILL.mdcore1,660 bytesSKILL.mdcore1,660 bytes
Read SKILL.md
# Supercov
Supercov runs the project's own test command and changes no source, tests or configuration. `npx supercov docs <topic>` prints the guide for the installed version; read it for anything not shown here. Topics: `agent-loop`, `quality`, `supported-suites`, `troubleshooting`.
## Add a test
1. Measure the full suite: `npx supercov -- <test command>`, for example `npx supercov -- npm test`.
2. List targets with `npx supercov runs latest gaps --limit 5`, pick one, and inspect it with `npx supercov runs latest file <path>`.
3. Write one focused test. Change only tests unless the user asks otherwise.
4. Rerun the same command and report the test and the coverage before and after.
## Quality
- `npx supercov quality` ranks files by code smells, and `npx supercov quality patch` reports what a change introduced.View the complete source on GitHubsupercov-security
When your agent uses it
Scans a repository's source for security vulnerabilities with the supercov CLI, pointing to the line of each finding and mapping it to CWE classes. Use when the user asks for a security scan or audit, whether code is secure, or to find vulnerabilities, injection, hardcoded secrets or other insecure code.
What it loads into context
Frontmatter
72 tokensAlways available to the agent
SKILL.md
208 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
Files
SKILL.mdcore942 bytesSKILL.mdcore942 bytesSKILL.mdcore942 bytesSKILL.mdcore942 bytes
Read SKILL.md
# Supercov security
Run `npx supercov security` for the whole repository, or `npx supercov security patch` for what a change introduced. It checks every source file for twelve named risks and points to the line. `npx supercov docs security` prints the guide for the installed version.
It sends source files to TypeSafe using the `TYPESAFE_API_KEY` environment variable. A user who set the key has opted in, so run it without asking again. If the key is missing the command says so: tell the user how to set it, then review the code by hand and say Supercov did not check it.View the complete source on GitHubSkills included
- supercov
- supercov-security
Repository facts
- License
- MIT
- Created
- Aug 23, 2026
- Last pushed
- Nov 6, 2026
- Forks
- 6
- Open issues
- 0
- Project activity
- Active
Before you install
Instructions onlyAutomated signals, not a guarantee
Checked Nov 5, 2026
Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.
Show 4 notes
plugins/supercov/skills/supercov/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedplugins/supercov/skills/supercov-security/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedplugins/supercov/skills/supercov-security/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedplugins/supercov/skills/supercov-security/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzed
- No broad tool permissions
- No dangerous shell commands
- 10 network referencesin 3 files: plugins/supercov/.claude-plugin/plugin.json:5 .claude-plugin/marketplace.json:4 supercov/SKILL.md:23
- No hidden or obfuscated text
- No instruction overrides
- No executable scripts
- 2 references to secretsin 2 files: supercov-security/SKILL.md:11 supercov/SKILL.md:21
- No requests to vote in Hot
Show all 12 signals by file
.claude-plugin/marketplace.json
plugins/supercov/.claude-plugin/plugin.json
- Network accessline 5
"author": { "name": "Supercorp", "url": "https://supercorp.ai" - Network accessline 6
"name": "Supercorp", "url": "https://supercorp.ai" }, - Network accessline 7
"url": "https://supercorp.ai" - Network accessline 8
}, "homepage": "https://supercov.com", "repository": "https://github.com/supercorp-ai/supercov", - Network accessline 9
"homepage": "https://supercov.com", - Network accessline 10
"repository": "https://github.com/supercorp-ai/supercov",
plugins/supercov/skills/supercov-security/SKILL.md
- Access to secretsline 11
[Credential-related source omitted]
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Some files could not be read; the facts below still hold.
Signal confidence: 3 facts
- Access to secrets in prose of the SKILL.mdsupercov-security/SKILL.md:11Low confidence
- Access to secrets in prose of the SKILL.mdsupercov/SKILL.md:21Low confidence
- Network access in prose of the SKILL.mdsupercov/SKILL.md:23Low confidence
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Native | Manifest .claude-plugin/marketplace.json | .claude/skills/<skill-name>/ |
| Codex | Compatible | Standard SKILL.md plugins/supercov/skills/supercov/SKILL.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md plugins/supercov/skills/supercov/SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md plugins/supercov/skills/supercov/SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md plugins/supercov/skills/supercov/SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md plugins/supercov/skills/supercov/SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.