start — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited start (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
One command to rule them all. Routes your task through the right skills, guarantees test infrastructure, and won't let you claim done without proof.
/start <task description>You MUST follow this sequence exactly. No shortcuts. No skipping steps.
This step runs EVERY time, before anything else. Do NOT skip any sub-step.
Check if testing.md exists at the project root.
If it does NOT exist:
package.json (test, test:e2e, test:integration, etc.)testing.md using the template below, filled in with real values from this project:# Testing Guide
## Environment Setup
- Package manager: [detected]
- Required env vars: [list with descriptions]
- Database: [commands to start/seed test DB, or "none"]
- Services: [docker-compose, external APIs, or "none"]
## Running Tests
### Unit Tests
Command: `[detected or recommend]`
Location: `tests/unit/`
### Integration Tests
Command: `[detected or recommend]`
Location: `tests/integration/`
### E2E Tests (Playwright)
Command: `npx playwright test`
Setup: `npx playwright install chromium`
Base URL: `[detected from config or recommend]`
Location: `tests/e2e/`
## Debugging Failed Tests
- Single test: `[framework-specific command]`
- Headed browser: `npx playwright test --headed`
- Traces: `npx playwright show-trace test-results/*/trace.zip` npm install -D @playwright/test && npx playwright install chromium/e2e-playwright.git commit -m "chore: add test infrastructure (testing.md, playwright)"If it exists: Read it. Then verify Playwright is installed (npx playwright --version). If not, install it now before proceeding.
Read CLAUDE.md. Classify the task as one of:
| Type | Route | Next step |
|---|---|---|
| feature | New functionality or significant change | Step 2 (Design) |
| bugfix | Something is broken | Step 3 (use /debug first) |
| refactor | Restructure without behavior change | Step 4 (write tests for existing behavior first) |
| e2e-only | Only adding/fixing E2E tests | Step 5 |
Run /brainstorm-and-plan with the task description.
After approval, proceed to Step 4.
Run /debug to investigate the bug.
Run /tdd for every implementation step.
For each piece of work:
Commit after every green cycle, not at the end.
Test Debt Handoff — before moving to Step 5:
Review the /tdd Behavior Coverage Checklist. List every E2E test owed:
E2E debts from Step 4:
- [ ] [describe the user workflow that needs an E2E test]
- [ ] [describe the nav change that needs a navigation test]
- [ ] [describe the bug fix that needs a browser-level regression test]Carry this list into Step 5. Every item MUST be covered before Step 6.
╔══════════════════════════════════════════════════════════════════╗
║ THIS STEP IS MANDATORY. YOU MUST NOT SKIP IT. ║
║ ║
║ "Playwright is not installed" → INSTALL IT (Step 0 should ║
║ have done this — if it didn't, install it now). ║
║ ║
║ "It would require significant setup" → THAT IS THE WORK. ║
║ Do the setup. That's what this step is for. ║
║ ║
║ "The user already approved without E2E" → The user approved ║
║ the PLAN. This pipeline requires E2E. Write them. ║
║ ║
║ "Unit tests already cover this" → Unit tests are not E2E. ║
║ E2E tests run a real browser. Write them. ║
║ ║
║ There is NO valid reason to skip this step. ║
╚══════════════════════════════════════════════════════════════════╝Before writing tests, verify Playwright works:
npx playwright --version # Must output a version numberIf this fails, run: npm install -D @playwright/test && npx playwright install chromium
Then run `/e2e-playwright` to write E2E tests covering:
request fixtureAfter writing E2E tests, confirm they pass:
npx playwright test --repeat-each=3If any test is flaky, diagnose and fix before proceeding. Do NOT move on with flaky tests.
Commit screenshot baselines:
If any tests use toHaveScreenshot(), Playwright generates baseline images in *.spec.ts-snapshots/ directories. These MUST be committed — they are the source of truth for visual regression.
# Check for generated screenshot baselines
find tests/e2e -name "*.spec.ts-snapshots" -type d
# If any exist, stage and commit them
git add tests/e2e/**/*.spec.ts-snapshots/
git commit -m "test: add Playwright screenshot baselines"Do NOT skip this. Without committed baselines, toHaveScreenshot() will fail on subsequent runs.
Screenshot requirement check:
Before answering the quality gate, run this check:
# Did this task change anything visual (CSS, HTML structure, styles, colors, layout)?
git diff HEAD~1 --stat -- '*.html' '*.css' '*.tsx' '*.jsx' '*.scss'If that diff is non-empty, you MUST have at least one toHaveScreenshot() call in your E2E tests. No exceptions. No "computed style is good enough." No "N/A." Screenshots and computed-style assertions serve different purposes — screenshots catch visual regressions you didn't think to assert on.
If you don't have one yet, write it now before proceeding.
E2E Quality Gate — answer ALL before proceeding to Step 6:
Every question below must be answered YES or DOES-NOT-APPLY. "N/A" is NOT a valid answer for questions that apply to your task. If you're unsure whether a question applies, the answer is YES it applies — write the test.
╔══════════════════════════════════════════════════════════════════╗
║ BEFORE proceeding: answer these questions honestly. ║
║ ║
║ □ Do tests exercise the feature's primary user workflow? ║
║ ("Page loads" is NOT a workflow) ║
║ ║
║ □ For bugfixes: does a test reproduce the original bug? ║
║ ║
║ □ For nav changes: do tests click nav items and verify ║
║ they route to the correct page with correct content? ║
║ ║
║ □ For API changes: do tests hit the actual endpoints and ║
║ verify responses? ║
║ ║
║ □ Would these tests catch a regression if someone broke ║
║ this feature tomorrow? ║
║ ║
║ □ Did you change CSS, HTML, styles, colors, or layout? ║
║ → Then at least one test MUST use toHaveScreenshot(). ║
║ → "Computed style assertions cover it" is NOT sufficient. ║
║ → Screenshots catch regressions you didn't think to assert. ║
║ ║
║ □ Are screenshot baselines committed? ║
║ → Run: find tests/e2e -name "*.spec.ts-snapshots" -type d ║
║ → If empty after a UI change, this gate FAILS. ║
║ ║
║ If ANY answer is NO → stay in Step 5 and write the missing ║
║ tests. Then re-run --repeat-each=3 and re-answer this gate. ║
║ Do NOT proceed until all boxes are checked. ║
║ ║
║ "Page loads without 404" is baseline, not coverage. ║
╚══════════════════════════════════════════════════════════════════╝Check every item from the Test Debt Handoff list (Step 4). Each debt must map to a passing E2E test. Uncovered debts = stay in Step 5.
If E2E tests are not written and passing, Step 6 (verify) MUST fail.
Run /verify-done.
If verification fails: Go back to the relevant step and fix. Do not skip re-verification.
/start add user authentication
→ Step 0 (testing.md) → Step 1 (feature) → Step 2 (brainstorm)
→ Step 4 (tdd) → Step 5 (e2e) → Step 6 (verify)
/start fix login redirect loop
→ Step 0 (testing.md) → Step 1 (bugfix) → Step 3 (debug)
→ Step 4 (tdd) → Step 5 (e2e) → Step 6 (verify)
/start extract auth into middleware
→ Step 0 (testing.md) → Step 1 (refactor) → Step 4 (tdd)
→ Step 5 (e2e) → Step 6 (verify)
/start add e2e tests for checkout
→ Step 0 (testing.md) → Step 1 (e2e-only) → Step 5 (e2e)
→ Step 6 (verify)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.