generate-tests — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited generate-tests (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Install-Module Pester -MinimumVersion 5.5.0 -Force./src/ (or specify path)./tests/ (parallel directory structure)Use AST to find all functions, their parameters, dependencies, and complexity:
# Discover all PowerShell source files
$sourceFiles = Get-ChildItem -Path ./src -Include '*.ps1','*.psm1' -Recurse
foreach ($file in $sourceFiles) {
$ast = [System.Management.Automation.Language.Parser]::ParseFile(
$file.FullName, [ref]$null, [ref]$null
)
# Find all function definitions
$functions = $ast.FindAll({
$args[0] -is [System.Management.Automation.Language.FunctionDefinitionAst]
}, $true)
# Find all command calls (dependencies to mock)
$commands = $ast.FindAll({
$args[0] -is [System.Management.Automation.Language.CommandAst]
}, $true)
Write-Host "$($file.Name): $($functions.Count) functions, $($commands.Count) commands"
}Output: Test Creation Report — file count, function count, testability scores (0-100%), anti-patterns flagged.
For each function, identify what needs mocking:
| Dependency Type | Detection | Mock Strategy |
|---|---|---|
| Az.* cmdlets | Get-Az*, New-Az*, Set-Az* | Mock Get-AzResource { [PSCustomObject]@{...} } |
| File I/O | Get-Content, Set-Content, Test-Path | Use TestDrive: PSDrive |
| Registry | Get-ItemProperty, Set-ItemProperty | Use TestRegistry: PSDrive |
| REST APIs | Invoke-RestMethod, Invoke-WebRequest | Mock with JSON response objects |
| Active Directory | Get-ADUser, Get-ADGroup | Mock with PSCustomObject hashtables |
| SQL | Invoke-Sqlcmd, Invoke-DbaQuery | Mock with DataTable objects |
| .NET types | [System.IO.File], [HttpClient] | Create thin wrapper function → mock wrapper |
| Authentication | Connect-AzAccount, Get-AzContext | Always mock — prevent real API calls |
Output: Dependency & Requirement Mapping Report — per-function parameters, return types, mock graph.
For each function, define the test matrix:
| Test Category | What to Test | Example It Block | ||
|---|---|---|---|---|
| Happy path | Normal input → expected output | It 'Returns compliant status' { ... Should -Be 'Compliant' } | ||
| Error path | Invalid input → throws | `It 'Throws on null input' { { Fn $null } \ | Should -Throw }` | |
| Edge cases | Empty array, $null, boundary | `It 'Handles empty collection' { Fn @() \ | Should -BeNullOrEmpty }` | |
| Parameter validation | Mandatory, ValidateSet | `It 'Rejects invalid scope' { { Fn -Scope 'Bad' } \ | Should -Throw }` | |
| Mock verification | Dependencies called correctly | It 'Calls API once' { Should -Invoke Get-AzResource -Times 1 -Exactly } | ||
| Pipeline | ValueFromPipeline input | `It 'Accepts pipeline' { 'input' \ | Fn \ | Should -Not -BeNullOrEmpty }` |
Output: Test Points Identification Report — per-function test matrix with categories.
Generate Pester 5.x test files following this exact structure:
#Requires -Modules Pester
BeforeAll {
. $PSScriptRoot/../src/Get-PolicyCompliance.ps1
}
Describe 'Get-PolicyCompliance' -Tag 'Unit' {
BeforeAll {
# Always mock authentication
Mock Connect-AzAccount { }
Mock Get-AzContext {
@{ Subscription = @{ Id = '00000000-0000-0000-0000-000000000000' } }
}
}
Context 'When policy is compliant' {
BeforeAll {
Mock Get-AzPolicyState {
[PSCustomObject]@{ ComplianceState = 'Compliant' }
}
}
It 'Returns compliant status' {
$result = Get-PolicyCompliance -PolicyName 'test-policy'
$result.State | Should -Be 'Compliant'
}
It 'Calls Get-AzPolicyState exactly once' {
Should -Invoke Get-AzPolicyState -Times 1 -Exactly
}
}
Context 'Parameter validation' {
It 'Throws when PolicyName is missing' {
{ Get-PolicyCompliance } | Should -Throw '*PolicyName*'
}
}
}BeforeAll for dot-sourcing (never script-scope)Should -BeTrue not Should -Be $trueShould -BeNullOrEmpty not Should -Be $nullShould -Invoke not Assert-MockCalled (deprecated)-Tag 'Unit' or -Tag 'Integration' on every Describe-TestCases or -ForEach for data-driven (no copy-paste It blocks)Get-Policy.ps1 → Get-Policy.Tests.ps1$config = New-PesterConfiguration
$config.Run.Path = './tests'
$config.Run.PassThru = $true
$config.CodeCoverage.Enabled = $true
$config.CodeCoverage.Path = './src'
$config.CodeCoverage.OutputFormat = 'JaCoCo'
$config.CodeCoverage.OutputPath = './reports/coverage.xml'
$config.CodeCoverage.CoveragePercentTarget = 90
$config.TestResult.Enabled = $true
$config.TestResult.OutputFormat = 'NUnitXml'
$config.TestResult.OutputPath = './reports/test-results.xml'
$config.Output.Verbosity = 'Detailed'
$result = Invoke-Pester -Configuration $configOutput: Code Coverage Report — line/branch/function % vs targets, uncovered lines.
If tests fail or coverage is below target:
$result.CodeCoverage.CommandsMissed — which lines uncoveredif/else → add Context with Mock that triggers the branchcatch → add It with Mock that throwsswitch → add -TestCases for each case valueOutput: Final Validation Report — test count, pass rate, coverage achieved, recommendations.
BeforeAll, Should -Invoke defaults to It scope and reports 0 calls. Always add -Scope Context.ParseFile to extract only function definitions, then Invoke-Expression each one.exit is a PowerShell keyword that cannot be mocked. When extracting functions that contain exit N, replace with throw "Exit code: N" or return $N.($data | Group-Object X).Count returns item count when there's a single group. Always use @($data | Group-Object X).Count to get group count.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.