ss-sdd-testing-implementation — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ss-sdd-testing-implementation (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Feature-level verification, separate from the per-task unit tests that ran during implementation. The tester subagent picks a strategy based on what kind of feature this is and what tools are actually available — Playwright for UI, DB MCPs for data verification, regular test runners always, code review as a last-resort fallback.
Core principle: The coordinator does NOT test itself. If the tester subagent reports MCP unavailability, the coordinator surfaces a manual test plan to the user — it does not improvise.
Each subagent loads a corresponding skill:
ss-sdd-testing-feature skillss-sdd-fixing-test-failures skillThe prompt templates in this directory are dispatch envelopes only; the protocols live in those skills.
Announce at start: "I'm using the ss-sdd-testing-implementation skill to run feature-level tests."
.sublime-skills/state.json. It is permanently gitignored. Do NOT bypass via git add -f, --force, git update-index, or any other mechanism. See state-schema.md "Git policy" for the full list.quick or standard)./tester-prompt.mdPASS → mark stage complete, hand off to finishingFAIL → dispatch fixer subagent with the failures; re-test; loop ≤3 timesMCP_UNAVAILABLE → surface tester's manual test plan + code-review findings to user, ask whether to proceedAsk the user, verbatim:
"How deep should the feature tests go? 1.quick— golden paths of each P1 user story only; no edge cases 2.standard— P1 stories + their listed edge cases, P2/P3 if cheap (default)
>
(Enter / no answer = standard)"
Accept exactly quick or standard. Anything else (Enter, "default", "ok") → treat as standard. Record the chosen value as DEPTH and pass it to the tester subagent in Step 3.
Do NOT persist the depth to state.json — it's a per-Stage-14-entry choice, not durable state. If the fix loop re-dispatches the tester later in the same skill invocation, reuse the same DEPTH (don't re-ask between iterations).
Read the plan's tech stack and file structure. Classify:
If uncertain, classify as `mixed` — the tester subagent handles both strategies anyway, and erring on the side of more coverage is safer than under-testing.
Pass this classification to the tester subagent.
Dispatch a fresh subagent with the prompt at ./tester-prompt.md. Fill placeholders:
{FEATURE_TYPE} — UI / backend / library / mixed{DEPTH} — quick or standard (from Step 1){SPEC_PATH} — for acceptance scenarios{PLAN_PATH} — for what was implemented{BRANCH} — current branch{BASE_SHA} — the merge-base with main{HEAD_SHA} — current HEADThe tester returns one of three statuses:
| Status | Meaning |
|---|---|
PASS | Ran real tests via available tools; everything passed |
FAIL | Ran real tests; issues found — list of failing scenarios with context |
MCP_UNAVAILABLE | Couldn't run real tests; here's a manual test plan + code review findings |
Update state file:
{
"current_stage": "testing_complete",
"test_status": "passed",
"stages_completed": [..., "testing_complete"]
}Hand off to ss-sdd-finishing.
The tester returns a list of failing scenarios with:
Dispatch a fresh subagent with ./fixer-prompt.md. Fill placeholders:
{FAILURES} — the failure list returned by the tester, verbatim (one block per failure with: story, scenario, expected, actual, likely location, reproduction){BRANCH} — current branch name{WORKING_DIR} — repo rootThe fixer's role is implementation-only — fix the listed issues, commit, return.
If the fixer reports BLOCKED due to a commit failure (pre-commit hook, signing, etc.), surface to user with the commit error output. Per the Commit Failure Protocol in ss-sdd-coordinator. Do NOT instruct the fixer to bypass hooks.
After the fixer reports DONE, re-dispatch the tester with the new HEAD SHA.
Loop cap: 3 iterations. Track in state file:
{
"test_status": "in_fix_loop",
"fix_iterations": 2
}After 3 failed iterations, stop and escalate:
"Three test-fix iterations didn't resolve the issues. The failures suggest [tester's summary]. The plan or spec may need revision. How would you like to proceed? 1. Pause SDD; I'll keep the branch and you can investigate 2. Revise the plan/spec and re-enter implementation 3. Accept the current state and proceed to finishing despite the failures"
Wait for user direction.
The tester couldn't run real tests due to missing tools (no browser MCP, no DB MCP, etc.). It returns:
The coordinator MUST NOT attempt to test on its own. Present the result to the user:
"Couldn't run automated tests for this feature — [tester's reason: no browser MCP / no DB MCP / etc.]. The tester did a code review fallback and produced a manual test plan:
>
[manual test plan]
>
[code review findings, if any]
>
Options: 1. Run the manual tests now and tell me the result 2. Skip testing and proceed to finishing 3. Pause SDD so you can configure the missing MCP and re-run testing later"
Wait for user direction.
If the user runs the manual tests and reports results, record them in state file and proceed accordingly.
After resolution, update state file:
{
"current_stage": "testing_complete" | "testing_skipped",
"test_status": "passed" | "passed_after_fixes" | "skipped_mcp_unavailable" | "skipped_user_choice" | "failed_escalated",
"fix_iterations": <N>,
"stages_completed": [..., "testing_complete"]
}Testing complete.
- Status: <pass/fail/skipped>
- Depth: <quick/standard>
- Feature type: <UI/backend/library/mixed>
- Tools used: <playwright | postgres-mcp | code-review-fallback>
- Fix iterations: <N>
- Manual test plan: <yes/no>| Mistake | Fix |
|---|---|
| Coordinator decides to "just test it myself" when MCP_UNAVAILABLE | NO — surface to user; testing is not the coordinator's job |
| Skipping the fix-loop cap | Hard cap at 3 — beyond that, plan/spec likely needs revision |
| Re-dispatching the same tester instance for fix verification | Fresh subagent each cycle — context isolation matters |
| Treating a FAIL with one trivial issue as "good enough" | Any FAIL means at least one fix iteration; don't shortcut |
| Conflating per-task unit tests with feature testing | Per-task tests happened during implementation; this stage is feature-level (golden paths + edge cases) |
Force-adding state.json with git add -f | NEVER. Zero exceptions. |
Editing .sublime-skills/.gitignore mid-pipeline | NEVER. The ignore is permanent. |
PASS or passed_after_fixes proceed automaticallygit add -f .sublime-skills/state.json → STOP.sublime-skills/.gitignore → STOP./tester-prompt.md./fixer-prompt.md~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.