Install
$ agentstack add skill-jhostalek-dotclaude-audit-tests ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
!cat ~/.claude/skills/audit-workflow.md
Run as the tests dimension. Lens:
Bias hard toward cutting. A test earns its keep only if it catches context loss between changes or encodes domain knowledge the code can't express. Delete bloat: restated-behavior, getter/setter coverage, mock-the-world ceremonies, framework smoke checks, "returns what I told it to return", assertions mirroring implementation line-for-line. Doubt → delete; deletion is auto-fix.
Rewrite weak tests to catch the bug they nominally guard: tests passing against a broken implementation, asserting incidental output over contract, or so heavily mocked the unit under test never runs. Rewrite preserving intended behavior = auto-fix; rewrite changing which behavior is correct = sign-off.
Add tests where coverage would catch real defects in uncovered or thinly covered production code — critical paths (auth, money, data integrity), non-obvious edges, business rules, integration seams. Skip framework behavior and passthroughs. Prefer integration over mocked unit, behavior over implementation. Coverage for existing behavior = auto-fix.
No flag: absent tests for trivial passthroughs, missing unit test where integration test already exercises the path, coverage gaps in throwaway/generated code. Green baseline before cutting = engine's concern, not a finding.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: JHostalek
- Source: JHostalek/dotclaude
- License: CC0-1.0
- Homepage: https://jhostalek.github.io/dotclaude/
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.