create-missing-tests-in-pr — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-missing-tests-in-pr (Agent Skill) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Constraint:
@rules/laravel/laravel.mdc, @rules/laravel/architecture.mdc, @rules/laravel/filament.mdc, and @rules/laravel/livewire.mdcand identify all testing recommendations related to current changes.
the existing create-test skill or test infrastructure, otherwise do not modify it — the only exception is the Pre-existing issue handling workflow below, which lands its production-code fixes in their own separate commits.
Read, Map & Verify before writing tests (mandatory pre-flight):
Reading, mapping, and verifying come first; writing tests comes last. This pre-flight is blocking — do not add or modify a single line until all three steps pass, and never act on an assumption you have not confirmed by reading the code.
Only after Read, Map, and Verify are complete may test-writing begin.
Steps:
gh) first.If gh is not available, use a GitHub MCP server. If neither is available, stop and return a failed result about missing GitHub tools.
scenarios, edge cases, regression coverage, and coverage gaps.
@skills/code-review/SKILL.md). Do not gate on the project-wide coverage percentage — if the project ships no coverage tooling at all, stop and report it as a blocker, and do not add a new bespoke coverage script to the consuming project.use @skills/create-test/SKILL.md.
abstractions.
required.
if, switch); split conditional logic into separate test cases instead.repeated test cases.
current changes.
with 100% coverage for the changed files only, using the project's available coverage tooling (per the Coverage gate in @skills/code-review/SKILL.md) — do not gate on the full-suite coverage percentage. Delete any generated coverage report file once read so it is not accidentally committed.
build.xml/phing.xml; fall back to Composer scripts in composer.json).changed files workflow.
do not duplicate test coverage.
App\Service\Billing\InvoiceCalculator → tests/Service/Billing/InvoiceCalculatorTest.php), the file name is {ClassName}Test.php (or {ClassName}{Scenario}Test.php for an extracted scenario file of the same SUT), and cross-cutting tests sit under an intent-named directory (tests/Feature/<flow>, tests/Contract/<vendor>, tests/Integration/<area>).it('returns zero for an empty cart') or test('throws InvalidArgumentException when the discount is negative'). Never use placeholders (it('it works'), test('test1'), test('happy path')), method names (test('calculate'), it('handles getUser')), or descriptions that contradict the assertions, so the code-review test-organization gate passes when the PR is re-reviewed.Deliver:
Provide a brief markdown summary including:
Pre-existing issue handling
While writing the missing tests, you may uncover problems that are unrelated to the current PR scope but were already present in the code you had to read or exercise. The following categories qualify:
.claude/rules/.@rules/security/backend.md, @rules/security/frontend.md, or @rules/security/mobile.md would flag.Rules:
@rules/git/general.mdc: fix(<scope>): pre-existing — <description> for bugs and security, refactor(<scope>): pre-existing — <description> for rule violations without behavior change.pre-existing — prefix is mandatory so reviewers can identify these commits at a glance.fix(<scope>): pre-existing — … (bug, security) — add the regression test in the same commit as the fix; the test must fail before the fix lands and pass after.refactor(<scope>): pre-existing — … (project-rule violation, behavior-preserving) — apply @rules/refactoring/general.mdc Test Coverage Contract: when the target lines are below 100% coverage, author a dedicated test(<scope>): cover <area> before pre-existing refactor commit before the refactor commit, and do not modify pre-existing tests inside the refactor commit (mechanical renames forced by the refactor itself stay exempt and must be flagged in the commit body).After completing the tasks
build.xml/phing.xml; fall back to Composer scripts in composer.json).@rules/php/core-standards.mdc PHP Practices).@rules/code-testing/general.mdc and fix any findings.verified.
uncovered scenario.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.