vitest-dev — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vitest-dev (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Claude Code skill for producing high-signal, low-flake, fast Vitest suites (TypeScript + Next.js 16) and for shaping Vitest configuration for optimal local DX and CI throughput.
When asked to add or improve tests:
jsdom (React) when DOM behavior is essentialtoHaveTextContent, role-based queries, etc.)src/foo.ts → src/foo.test.tssrc/components/Button.tsx → src/components/Button.test.tsx__tests__ for framework-driven routes when colocation is awkward (Next example uses this convention).describe('<unit>') with focused it('does X when Y').vitest (watch mode by default when TTY is detected).vitest run (forces a single run and is non-interactive).From the Vitest CLI guide, Vitest defaults to watch mode when process.stdout.isTTY is true and falls back to run mode otherwise, while vitest run always runs once. (See: https://vitest.dev/guide/cli)
node for backend/unit testsjsdom (or happy-dom) for React component testsVitest runs test files using a pool (forks, threads, vmThreads, vmForks). By default (Vitest v4 docs) it uses `forks`. threads can be faster but may break libraries that use native bindings; forks uses child_process and supports process APIs like process.chdir(). (See: https://vitest.dev/config/pool)
Rule of thumb:
threads for “pure JS/TS” unit tests.forks if you use:process.* APIs that are not available in threadstest.isolate defaults to true. Disabling can improve performance when tests don’t rely on side effects (often true for Node-only units). (See: https://vitest.dev/config/isolate)
Rule of thumb:
isolate: true for frontend/component tests (jsdom) and any suite that touches global state.isolate: false for Node-only pure units after you have strong isolation discipline.test.fileParallelism default is true. Setting it to false forces single-worker execution by overriding maxWorkers to 1. (See: https://vitest.dev/config/fileparallelism)test.maxWorkers defaults to:It also accepts a percentage string like "50%". (See: https://vitest.dev/config/maxworkers)
test.maxConcurrency controls how many test.concurrent tests can run simultaneously, default 5. (See: https://vitest.dev/config/maxconcurrency)Vitest caching is enabled by default and uses node_modules/.vite/vitest. (See: https://vitest.dev/config/cache)
For CI, persist this directory between runs (per branch key) for significant speedups.
Use Next’s recommended baseline:
vitest, @vitejs/plugin-react, jsdom, @testing-library/react, @testing-library/dom, vite-tsconfig-paths.test.environment = 'jsdom' with the React + tsconfigPaths plugins.(See: https://nextjs.org/docs/app/guides/testing/vitest)
Important limitation noted by Next.js: Vitest currently does not support async Server Components; for async components, use E2E tests instead. (See the same Next.js guide above.)
vi.spyOn) for verifying interactionsvi.mock) only when necessaryafterEach(() => vi.restoreAllMocks())afterEach too.Use fake timers to avoid slow sleeps. Vitest’s docs show using vi.useFakeTimers() with vi.runAllTimers() / vi.advanceTimersByTime() to speed time-based code. (See: https://vitest.dev/guide/mocking/timers)
Advanced note: if you configure fakeTimers.toFake to include nextTick, it is not supported with --pool=forks because Node’s child_process uses process.nextTick internally and can hang; it is supported with --pool=threads. (See: https://vitest.dev/config/faketimers)
junit to export JUnit XML (for most CI systems). (See: https://vitest.dev/guide/reporters)github-actions reporter when GITHUB_ACTIONS === 'true' if default reporters are used; if you override reporters, add it explicitly. (See: https://vitest.dev/guide/reporters)Use --shard with the blob reporter and merge at the end. Vitest recommends the blob reporter for sharded runs and provides --merge-reports. (See: https://vitest.dev/guide/reporters)
Use test.projects to run multiple configurations in one process (monorepos or mixed environments). Vitest notes the older “workspace” name is deprecated in favor of projects. (See: https://vitest.dev/guide/projects)
Patterns:
environment: 'node', pool: 'threads', isolate: falseenvironment: 'jsdom', isolate: trueWhen invoked, this skill can generate or update:
vitest.config.ts, multi-project configs, CI overridessetupTests.ts, test utils, mocksBefore finalizing, ensure:
setTimeout waits), real network, or real clock time without explicit control.vitestvitest run~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.