test-first-bugs — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited test-first-bugs (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Enforce a disciplined bug-fixing workflow that prevents regression and parallelizes fix attempts.
When a bug is reported, follow these steps in order:
tests/, __tests__/, spec/, *.test.*, *.spec.* patterns)subagent_type=general-purpose to attempt fixesName the test to describe the bug:
# Python (pytest)
def test_user_login_fails_when_email_has_uppercase():
...
# Python (unittest)
def test_should_handle_empty_input_without_crashing(self):
...// JavaScript (Jest/Vitest)
it('should not crash when input array is empty', () => { ... });
test('handles special characters in username', () => { ... });// TypeScript
describe('UserService', () => {
it('returns null when user not found instead of throwing', () => { ... });
});Every bug reproduction test follows this pattern:
def test_bug_description():
# 1. ARRANGE - Set up the conditions that trigger the bug
input_data = create_problematic_input()
# 2. ACT - Perform the action that causes the bug
result = function_under_test(input_data)
# 3. ASSERT - Verify the expected (correct) behavior
assert result == expected_value # This should FAIL initiallyCheck the project structure for existing test patterns:
# Find test files
find . -name "*.test.*" -o -name "*.spec.*" -o -name "test_*.py" | head -20
# Find test directories
ls -la tests/ __tests__/ spec/ test/ 2>/dev/null
# Check package.json for test command
grep -A5 '"test"' package.jsonUse the Task tool to parallelize fix attempts:
Task tool parameters:
- subagent_type: "general-purpose"
- description: "Fix [bug description]"
- prompt: Include:
1. The bug description
2. The failing test location and contents
3. Suspected cause (if known)
4. Constraint: "Run the test to verify your fix works"Launch multiple subagents with different approaches:
If the project has no test infrastructure:
# Python
pip install pytest
mkdir -p tests && touch tests/__init__.py
# JavaScript/TypeScript
npm install --save-dev jest
# or
npm install --save-dev vitest
# Go
# Tests are built-in, create *_test.go filesAfter subagent reports completion:
# Run the specific test
pytest tests/test_module.py::test_bug_description -v
npm test -- --grep "bug description"
go test -run TestBugDescription -v
# Run full suite to check for regressions
pytest
npm test
go test ./...User reports: "The login function crashes when email has spaces"
Phase 1 — Write failing test:
# tests/test_auth.py
def test_login_handles_email_with_spaces():
"""Bug: Login crashes when email contains spaces"""
auth = AuthService()
# This should return an error, not crash
result = auth.login("user @example.com", "password")
assert result.success == False
assert "invalid email" in result.error.lower()Run test to confirm it fails:
pytest tests/test_auth.py::test_login_handles_email_with_spaces -v
# Expected: FAILED (demonstrates the bug)Phase 2 — Launch subagent:
Task tool:
- subagent_type: "general-purpose"
- description: "Fix email space crash"
- prompt: "Fix the login crash when email contains spaces.
Bug: AuthService.login() crashes instead of returning error when email has spaces.
Failing test: tests/test_auth.py::test_login_handles_email_with_spaces
After fixing, run: pytest tests/test_auth.py::test_login_handles_email_with_spaces -v
The test must pass to confirm the fix."Phase 3 — Verify:
# Specific test passes
pytest tests/test_auth.py::test_login_handles_email_with_spaces -v
# PASSED
# No regressions
pytest tests/test_auth.py -v
# All tests passThe bug-report-detector hook in this plugin automatically:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.