web-testing-vitest-071cac — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited web-testing-vitest-071cac (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Quick Guide: Vitest is a fast, Vite-native test runner. Usedescribe/it/expectfor test structure,vi.fn()for mocks,vi.mock()for module mocking,vi.spyOn()for spying. Co-locate tests with code. Use network-level API mocking over module-level mocks. Vitest v4 is current stable (requires Vite 6+, Node 20+).
<critical_requirements>
All code must follow project conventions in CLAUDE.md (kebab-case, named exports, import ordering, import type, named constants)(You MUST co-locate tests with code in feature-based structure - NOT in separate test directories)
(You MUST use network-level API mocking - NOT module-level mocks where possible)
(You MUST use named constants for test data - no magic strings or numbers in test files)
(You MUST use `vi.fn()` for mocks and `vi.spyOn()` for spying - NEVER manually replace functions)
(You MUST use the v3+ test options syntax: `test("name", { timeout: 10_000 }, () => {})` - NOT as third argument)
</critical_requirements>
Auto-detection: Vitest, vi.fn, vi.mock, vi.spyOn, describe, it, expect, test, beforeEach, afterEach, vi.useFakeTimers, vitest.config, defineConfig, coverage, snapshot, mockResolvedValue, mockRejectedValue
When to use:
When NOT to use:
Key patterns covered:
Detailed Resources:
<philosophy>
Vitest is a Vite-native test runner designed for speed and developer experience. It provides Jest-compatible APIs with native ESM support, TypeScript out of the box, and Vite's transform pipeline.
Core Principles:
When to use Vitest:
When NOT to use Vitest:
</philosophy>
<patterns>
Write unit tests for pure functions with no side effects. Focus on clear input/output behavior.
What to test:
See examples/core.md for pure function test examples.
Use Vitest with network-level API mocking to test components with their API integration layer.
When Integration Tests Make Sense:
Key Pattern:
__tests__/ directories co-located with codeSee examples/integration.md for integration test examples.
Co-locate tests with code in feature-based structure. Tests live next to what they test.
Direct Co-location (Recommended):
src/
features/
auth/
components/
login-form.tsx
login-form.test.tsx # Test next to component
hooks/
use-auth.ts
use-auth.test.ts # Test next to hookAlternative: `__tests__/` Subdirectories:
src/features/auth/
components/
login-form.tsx
__tests__/
login-form.test.tsxE2E Test Organization:
tests/
e2e/
auth/
login-flow.spec.ts
register-flow.spec.ts
checkout/
checkout-flow.spec.tsFile Naming Convention:
*.test.tsx / *.test.ts for unit and integration testsChoose one pattern and be consistent across the codebase.
</patterns>
<red_flags>
High Priority Issues:
vi.mock) instead of network-level - breaks when import structure changes, doesn't test serializationMedium Priority Issues:
Gotchas & Edge Cases:
test("name", { timeout: 10_000 }, () => {}) NOT test("name", () => {}, { timeout: 10_000 })vi.fn().mock.invocationCallOrder starts at 1 in v4 instead of 0vi.restoreAllMocks() only affects manual spies in v4, not automocks - use vi.resetAllMocks() for full reset</red_flags>
<critical_reminders>
All code must follow project conventions in CLAUDE.md
(You MUST co-locate tests with code in feature-based structure - NOT in separate test directories)
(You MUST use network-level API mocking - NOT module-level mocks where possible)
(You MUST use named constants for test data - no magic strings or numbers in test files)
(You MUST use `vi.fn()` for mocks and `vi.spyOn()` for spying - NEVER manually replace functions)
(You MUST use the v3+ test options syntax: `test("name", { timeout: 10_000 }, () => {})` - NOT as third argument)
Failure to follow these rules will result in fragile tests that break on refactoring and false confidence from poorly structured test suites.
</critical_reminders>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.