test-patterns — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited test-patterns (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A test's job is to fail when the behavior is wrong. Most mediocre tests pass whether the code is right or not.
Bad:
expect(spy).toHaveBeenCalled()Good:
expect(response.body.status).toBe('completed')
expect(db.getUser(id).lastSeenAt).toBe(mockNow)Spy-assertions fail on refactor and protect nothing. Behavior-assertions fail when the user-visible contract breaks.
Many expect lines can add up to one assertion of one outcome — that's fine. What's not fine: one test that covers three unrelated behaviors so nobody can tell what broke when it fails.
it('rejects stale tokens', () => {
// Arrange
const token = signToken({ exp: yesterday() })
// Act
const result = verify(token)
// Assert
expect(result.ok).toBe(false)
expect(result.reason).toBe('expired')
})test.each([
['empty', '', 'required'],
['too short', 'ab', 'min_length'],
['has space', 'a b', 'invalid_char'],
['ok', 'alice', null],
])('validateUsername(%s=%j)', (_, input, expected) => {
expect(validateUsername(input).error).toBe(expected)
})If three tests set up the same validUser, extract it. If the setup is 20 lines, it's probably doing too much — mock less, use a real test DB.
The test name is a sentence the reader can understand without opening the code. it('rejects stale tokens') > it('test2').
Unit tests are great for pure logic. For "this endpoint returns the right data for this user" you want an integration test that hits a real database, a real router, and a real serializer. Mocks hide the bugs you actually ship.
getByTestId last.userEvent over fireEvent.setUp.parametrize for table tests.-k and markers to target — CI can split suites.t.Run(tt.name, func(t *testing.T) { ... }).t.Cleanup over defer for teardown.describe.each + test.each for tables.toHaveBeenCalled when you can check the effect instead.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.