mushi-test — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mushi-test (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Live App → map stories → generate tests → approve → run → analyze failures → improve → repeat# Automatic discovery from live app (recommended)
mushi stories map --url https://your-app.com --wait
# Or use the console: Inventory → Discovery → "Map from live app"Review the draft in Inventory → Discovery → Past proposals and click Accept.
# From CLI (after accepting a proposal)
mushi tdd gen <story-id> --mode review
# Options:
# --mode auto → enabled immediately, no approval needed
# --mode review → lands in pending queue (default)
# --no-pr → skip GitHub PR
# Or via MCP in Cursor:
# generate_tdd_from_story(projectId, storyNodeId, automationMode: 'review')Each generated test includes:
@playwright/test)# See what needs review
mushi tdd pending
# Approve a test (enables it in QA schedule)
mushi tdd approve <qa-story-id>
# Reject a test
mushi tdd approve <qa-story-id> --rejectIn the console: QA Coverage → "TDD Tests Pending Review" banner shows the queue.
Tests run automatically on cron (default: hourly).
# Trigger manually
mushi tdd run <qa-story-id>
# Or via MCP: run_qa_story(projectId, qaStoryId)Monitor results in QA Coverage — each card shows pass rate, last run status, and Browserbase replay link.
When tests fail repeatedly, the PDCA improver proposes fixes:
# Run immediately
mushi tdd improve
# Runs automatically every 6 hours via pg_cronImproved tests appear in the pending review queue with source=pdca and a (PDCA v2) suffix.
| Mode | What happens | Use when |
|---|---|---|
auto | Tests run immediately after generation | You trust the LLM output, CI-only projects |
review | Tests queued for human approval | Default — verify before running in schedule |
approve | Same as review | Explicit approval-first workflow |
# Install Playwright
npx playwright install chromium
# Run a generated test file
BASE_URL=https://your-app.com npx playwright test tests/user-login.spec.tsVia MCP in Cursor:
list_pending_review_stories(projectId) → shows queue
get_map_run_status(projectId) → shows recent crawlsVia CLI:
mushi tdd pending # approval queue
mushi stories map --url <url> --wait # re-map after app changesmushi tdd gen) — it may fail on first run if UI changedmushi tdd improve) fixes selector/timing issuesThe parent_story_id chain tracks test lineage across PDCA iterations.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.