solidity-testing — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited solidity-testing (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MyToken.sol → MyToken.t.soltest/ directorytest_<feature>_<scenario> for passing tests, testFail_<feature>_<scenario> for expected revertstest_transfer_revertsWhenInsufficientBalancetest_stake_updatesBalanceCorrectlysetUp() for shared state, no cross-test dependencies--match-test and --match-contract for targeted runsEvery core function must have tests covering:
| Scenario | What to verify |
|---|---|
| Happy path | Standard input → expected output, correct state changes |
| Permission checks | Unauthorized caller → vm.expectRevert with correct error |
| Boundary conditions | Zero values, max values (type(uint256).max), off-by-one |
| Failure scenarios | Every require / revert / custom error path |
| State changes | Storage updates, balance changes, event emissions (vm.expectEmit) |
| Edge cases | Empty arrays, duplicate calls, self-transfers |
| Cheatcode | Usage |
|---|---|
vm.prank(addr) | Next call from addr |
vm.startPrank(addr) | All calls from addr until vm.stopPrank() |
vm.warp(timestamp) | Set block.timestamp |
vm.roll(blockNum) | Set block.number |
vm.deal(addr, amount) | Set ETH balance |
vm.expectRevert(error) | Next call must revert with specific error |
vm.expectEmit(true,true,false,true) | Verify event emission (topic checks) |
vm.record() / vm.accesses() | Track storage reads/writes |
makeAddr("name") | Create labeled address for readable traces |
function testFuzz_<name>(uint256 amount) publicvm.assume() to constrain inputs: vm.assume(amount > 0 && amount < MAX_SUPPLY);forge test --fuzz-runs 10000# Run all tests
forge test
# Run specific test function
forge test --match-test test_transfer
# Run specific test contract
forge test --match-contract MyTokenTest
# Verbose output with full trace
forge test -vvvv
# Gas report
forge test --gas-report
# Fuzz with more runs
forge test --fuzz-runs 10000
# Test coverage
forge coverage
# Coverage with report
forge coverage --report lcov~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.