test-driven-development — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited test-driven-development (Agent Skill) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
@rules/php/core-standards.mdc@rules/code-testing/general.mdc@rules/laravel/laravel.mdc, @rules/laravel/architecture.mdc, @rules/laravel/filament.mdc, and @rules/laravel/livewire.mdc@skills/create-test/SKILL.mdIf you did not watch the test fail, you do not know whether it tests the right thing.
NO PRODUCTION CODE WITHOUT A FAILING TEST FIRST
Reading, mapping, and verifying come first; implementing comes last. This pre-flight is blocking — do not add or modify a single line of production code until all three steps pass, and never act on an assumption you have not confirmed by reading the code.
Only after Read, Map, and Verify are complete may the first RED test be written.
Before writing the first failing test, run @skills/prepare-issue-context/SKILL.md with MODE=tdd and the assignment reference, scoped to the scenario(s) the upcoming RED step will cover. The skill seeds the development database with the records the failing test will depend on and captures a reproduction record (entry point + inputs + observed output) that becomes the arrange block of the first test. If the skill returns blocked: <count> open gap(s), stop and surface the gaps — writing a RED test against missing or guessed fixtures is the most common cause of stub-grade tests that drift from real behavior.
Write one minimal test for the next behavior.
covers()Run the test and confirm:
If the test passes immediately, it does not prove the new behavior.
Write the smallest production change needed to make the test pass.
Run the relevant tests and confirm:
Only after green:
Move to the next behavior and repeat the cycle.
RED is a state of the working tree, never a state of the published history. The cycle above runs entirely before anything is committed: the failing test from step 1, the production change from step 3 that makes it pass, and the refactor from step 5 land together as one commit, made only once step 4 is green.
git bisect will blame it for a regression it does not carry (@rules/git/general.mdc Git Rules — Every commit is green).->skip() / ->todo() / markTestIncomplete(), no assertion inverted "for now", no commented-out assertion, no fixture pinned to the buggy output. If the behavior is not fixed yet, the test does not get committed yet.@skills/git-workflow/SKILL.md).Never fix a bug without first writing or updating a test that reproduces it.
build.xml/phing.xml; fall back to Composer scripts in composer.json).@rules/php/core-standards.mdc PHP Practices).@rules/code-testing/general.mdc and fix any findings.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.