testing-laravel — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited testing-laravel (Agent Skill) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use PHPUnit with Laravel's testing helpers. Every test file starts with declare(strict_types=1).
tests/Feature/): HTTP requests through the full stack — routes, controllers, middleware, validation, database. Use $this->getJson(), $this->postJson(), etc.tests/Unit/): Isolated logic — services, actions, value objects, helpers. No HTTP, minimal database.Default to feature tests for anything touching routes, controllers, or models. Use unit tests for pure logic and action classes.
use RefreshDatabase trait in every test class that touches the databaseDB::table() insertstest_ prefix: test_user_can_update_own_profileactingAs($user) for auth — use this instead of manually setting sessions or tokenspostJson() / getJson() for API endpoints — sets proper Accept headers and returns JSON assertionsQueue::fake() then act then Queue::assertPushed(...)assertDatabaseHas / assertDatabaseMissing to verify persistence — use these instead of re-queryingresolve() so DI works; use swap() to inject mocks<?php
declare(strict_types=1);
namespace Tests\Feature;
use App\Models\{User, Post};
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;
final class PostTest extends TestCase
{
use RefreshDatabase;
public function test_authenticated_user_can_create_post(): void
{
$user = User::factory()->create();
$response = $this->actingAs($user)
->postJson('/api/posts', ['title' => 'New Post', 'body' => 'Content']);
$response->assertCreated()
->assertJson(['data' => ['title' => 'New Post']]);
$this->assertDatabaseHas('posts', [
'title' => 'New Post',
'user_id' => $user->id,
]);
}
}Data providers for boundary/validation testing:
#[DataProvider('titleLengthProvider')]
public function test_validates_title_length(string $title, bool $valid): void
{
$user = User::factory()->create();
$response = $this->actingAs($user)
->postJson('/api/posts', ['title' => $title, 'body' => 'Content']);
$valid ? $response->assertCreated() : $response->assertUnprocessable();
}
public static function titleLengthProvider(): array
{
return [
'too short' => ['AB', false],
'minimum valid' => ['ABC', true],
'maximum valid' => [str_repeat('A', 255), true],
'too long' => [str_repeat('A', 256), false],
];
}See feature testing patterns for auth, validation, API, console, and DB assertions.
See mocking and faking for facade fakes (Queue, Event, Notification, Mail, Storage, Http), action mocking with swap(), and Mockery.
See factories for states, relationships, sequences, and afterCreating hooks.
For large test suites, call PHPUnit directly to avoid artisan's memory overhead:
./vendor/bin/phpunit # all tests (direct, lower memory)
./vendor/bin/phpunit --filter=PostTest # by name
./vendor/bin/phpunit --processes=auto # parallel (PHPUnit 11+)
./vendor/bin/phpunit --coverage-text --min=80 # with coverage threshold
php artisan test # small suites or quick runs
php -d memory_limit=1G artisan test # if artisan needed on large suites~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.