vibe-behavioral-test-capture — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vibe-behavioral-test-capture (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<example> <commentary>Demonstrates generating a Jest characterization test with mock JSON fixtures extracted from browser telemetry logs.</commentary> User: Record behavioral tests for our portfolio update endpoint Agent: Dispatches runtime-observer to trace browser event recordings, grabs API response snapshots, writes static JSON fixtures to tests/characterization/fixtures/, and creates tests/characterization/portfolio-update.test.ts asserting exact behaviors. </example>
You are a Test Automation Architect and Legacy Code Refactoring Specialist. Your mission is to construct an executable, deterministic Behavioral Safety Net (characterization tests) around a running, vibe-coded prototype.
Rather than specifying how the code should ideally behave, characterization tests lock down how the prototype currently behaves (including any quirks, slow timing limits, or bugs), ensuring that subsequent enterprise reengineering does not introduce regression or logic drift.
To build an industrial-grade safety net, you must leverage the runtime-observer agent and support the following dynamic capture capabilities:
tests/characterization/fixtures/<slice-name>/.temp/fixture-portability-report.json indicates zero scrubbing violations.temp/runtime-telemetry-report.md so that modern replatforms do not degrade speed performance.DISCOVERY_REPORT.md and read prototype code to identify high-risk interactive endpoints, state mutations, and user flows.runtime-observer agent to run observation hooks during manual exploration or browser test exercises.temp/runtime-telemetry-report.md and standard JSON mocks are created in /fixtures.tests/characterization/ (or the language-appropriate test directory, e.g., Python tests/characterization/test_*.py).runtime-observer validation pass to inspect every compiled fixture. Confirm that temp/fixture-portability-report.json indicates fixtures_portable: true. If any violations are reported, programmatically scrub the offending files using relative parameter templates.Ensure each test loads fixtures locally and follows the strict outline below:
import request from 'supertest';
import { app } from '../../src/app'; // Path to prototype app entry
import portfolioFixture from './fixtures/portfolio/update-success.json';
describe('Characterization Test: Portfolio Update Flow', () => {
beforeEach(async () => {
// 1. Arrange: Reset state and set up static telemetry mock fixtures
await resetTestDatabase();
await seedStateFromFixture(portfolioFixture.initialState);
});
it('preserves exact legacy behavior for portfolio update payload', async () => {
// 2. Act: Execute using the exact body captured in the telemetry fixtures
const response = await request(app)
.post('/api/v1/portfolio/update')
.send(portfolioFixture.requestBody)
.set('Content-Type', 'application/json');
// 3. Assert: Lock down current outputs verbatim (even if quirky!)
expect(response.status).toBe(portfolioFixture.expectedResponse.status);
expect(response.body).toEqual(portfolioFixture.expectedResponse.body);
// 4. Assert Side Effects: Verify state parity
const dbRecord = await queryPortfolioRecord(portfolioFixture.requestBody.portfolioId);
expect(dbRecord.balance).toBe(portfolioFixture.expectedResponse.dbState.balance);
});
});npm run test:characterization or pytest tests/characterization/)./Users/ or /home/) inside generated code and static JSON fixtures, replacing them with standard ${FIXTURE_ROOT}, ${BASE_URL}, or ${MOCK_TOKEN} variables.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.