skills/testgen/SKILL.md
Generate tests with expert routing, framework detection, and auto-TaskCreate. Triggers on: generate tests, write tests, testgen, create test file, add test coverage.
npx skillsauth add 0xDarkMatter/claude-mods testgenInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Generate comprehensive tests with automatic framework detection, expert agent routing, and project convention matching.
testgen <target> [--type] [--focus] [--depth]
│
├─→ Step 1: Analyze Target
│ ├─ File exists? → Read and parse
│ ├─ Function specified? → Extract signature
│ ├─ Directory? → List source files
│ └─ Find existing tests (avoid duplicates)
│
├─→ Step 2: Detect Framework (parallel)
│ ├─ package.json → jest/vitest/mocha/cypress/playwright
│ ├─ pyproject.toml → pytest/unittest
│ ├─ go.mod → go test
│ ├─ Cargo.toml → cargo test
│ ├─ composer.json → phpunit/pest
│ └─ Check existing test patterns
│
├─→ Step 3: Load Project Standards
│ ├─ AGENTS.md, CLAUDE.md conventions
│ ├─ Existing test file structure
│ └─ Naming conventions (*.test.ts vs *.spec.ts)
│
├─→ Step 4: Route to Expert Agent
│ ├─ .ts → typescript-expert
│ ├─ .tsx/.jsx → react-expert
│ ├─ .vue → vue-expert
│ ├─ .py → python-expert
│ ├─ .go → go-expert
│ ├─ .rs → rust-expert
│ ├─ .php → laravel-expert
│ ├─ E2E/Cypress → cypress-expert
│ ├─ Playwright → typescript-expert
│ ├─ --visual → Chrome DevTools MCP
│ └─ Multi-file → parallel expert dispatch
│
├─→ Step 5: Generate Tests
│ ├─ Create test file in correct location
│ ├─ Follow detected conventions
│ └─ Include: happy path, edge cases, error handling
│
└─→ Step 6: Integration
├─ Auto-create task (TaskCreate) for verification
└─ Suggest: run tests, /review, /save
# Check if target exists
test -f "$TARGET" && echo "FILE" || test -d "$TARGET" && echo "DIRECTORY"
# For function-specific: extract signature
command -v ast-grep >/dev/null 2>&1 && ast-grep -p "function $FUNCTION_NAME" "$FILE"
# Fallback to ripgrep
rg "(?:function|const|def|public|private)\s+$FUNCTION_NAME" "$FILE" -A 10
Check for existing tests:
fd -e test.ts -e spec.ts -e test.js -e spec.js | rg "$BASENAME"
fd "test_*.py" | rg "$BASENAME"
JavaScript/TypeScript:
cat package.json 2>/dev/null | jq -r '.devDependencies | keys[]' | grep -E 'jest|vitest|mocha|cypress|playwright|@testing-library'
Python:
grep -E "pytest|unittest|nose" pyproject.toml setup.py requirements*.txt 2>/dev/null
Go:
test -f go.mod && echo "go test available"
Rust:
test -f Cargo.toml && echo "cargo test available"
PHP:
cat composer.json 2>/dev/null | jq -r '.["require-dev"] | keys[]' | grep -E 'phpunit|pest|codeception'
# Claude Code conventions
cat AGENTS.md 2>/dev/null | head -50
cat CLAUDE.md 2>/dev/null | head -50
# Test config files
cat jest.config.* vitest.config.* pytest.ini pyproject.toml 2>/dev/null | head -30
Test location conventions:
# JavaScript
src/utils/helper.ts → src/utils/__tests__/helper.test.ts # __tests__ folder
→ src/utils/helper.test.ts # co-located
→ tests/utils/helper.test.ts # separate tests/
# Python
app/utils/helper.py → tests/test_helper.py # tests/ folder
→ tests/utils/test_helper.py # mirror structure
# Go
pkg/auth/token.go → pkg/auth/token_test.go # co-located (required)
# Rust
src/auth.rs → src/auth.rs (mod tests { ... }) # inline tests
→ tests/auth_test.rs # integration tests
| File Pattern | Primary Expert | Secondary |
|--------------|----------------|-----------|
| *.ts | typescript-expert | - |
| *.tsx, *.jsx | react-expert | typescript-expert |
| *.vue | vue-expert | typescript-expert |
| *.py | python-expert | - |
| *.go | go-expert | - |
| *.rs | rust-expert | - |
| *.php | laravel-expert | - |
| *.cy.ts, cypress/* | cypress-expert | - |
| *.spec.ts (Playwright) | typescript-expert | - |
| playwright/*, e2e/* | typescript-expert | - |
| *.sh, *.bash | bash-expert | - |
| (--visual flag) | Chrome DevTools MCP | typescript-expert |
Invoke via Task tool:
Task tool with subagent_type: "[detected]-expert"
model: "sonnet"
Prompt includes:
- Skill preloading (domain knowledge):
"First, read these files for testing context:
- Read: skills/security-ops/references/owasp-detailed.md
- Read: skills/testing-ops/SKILL.md"
- Source file content
- Function signatures to test
- Detected framework and conventions
- Requested test type and focus
Language-specific preloads (append to the preloading section above):
| Expert | Additional Preload | Why |
|--------|-------------------|-----|
| python-expert | skills/python-pytest-ops/SKILL.md | Fixtures, marks, parametrize, async testing |
| go-expert | skills/go-ops/SKILL.md | Table-driven tests, benchmarks, testify |
| rust-expert | skills/rust-ops/SKILL.md | Property testing, criterion, proptest |
Test categories based on --focus:
| Focus | What to Generate |
|-------|------------------|
| happy | Normal input, expected output |
| edge | Boundary values, empty inputs, nulls |
| error | Invalid inputs, exceptions, error handling |
| all | All of the above (default) |
Depth levels:
| Depth | Coverage |
|-------|----------|
| quick | Happy path only, 1-2 tests per function |
| normal | Happy + common edge cases (default) |
| thorough | Comprehensive: all paths, mocking, async |
Auto-create task:
TaskCreate:
subject: "Run generated tests for src/auth.ts"
description: "Verify generated tests pass and review edge cases"
activeForm: "Running generated tests for auth.ts"
Suggest next steps:
Tests generated: src/auth.test.ts
Next steps:
1. Run tests: npm test src/auth.test.ts
2. Review and refine edge cases
3. Use /save to persist tasks across sessions
[]struct pattern)testing.T and subtests (t.Run)testing.B)t.Parallel())#[test] attribute functions#[cfg(test)] module organization#[should_panic] for error testing| Tool | Purpose | Fallback |
|------|---------|----------|
| jq | Parse package.json | Read tool |
| rg | Find existing tests | Grep tool |
| ast-grep | Parse function signatures | ripgrep patterns |
| fd | Find test files | Glob tool |
| Chrome DevTools MCP | Visual testing (--visual) | Playwright/Cypress |
Graceful degradation:
command -v jq >/dev/null 2>&1 && cat package.json | jq '.devDependencies' || cat package.json
For framework-specific code examples, see:
frameworks.md - Complete test examples for all supported languagesvisual-testing.md - Chrome DevTools integration for --visual flag| Command | Relationship |
|---------|--------------|
| /review | Review generated tests before committing |
| /explain | Understand complex code before testing |
| /save | Track test coverage goals |
tools
Behavioural-first software supply chain defense - catches poisoned npm/PyPI packages in the publish-to-advisory window that CVE tools miss. Use BEFORE every install or version bump (not only when an attack is suspected) - the 7-day cooldown gate + behavioural score catches freshly-published malware that CVE tools won't see for days. Socket.dev integration (free CLI + GitHub app + depscore MCP for Claude Code), stale-OIDC audit, dependency cooldown policy, publish-token rotation, VS Code extension audit, and a self-integrity scan that detects worm persistence hooks injected into Claude Code / VS Code settings. Triggers on: pip install, uv add, uv tool install, npm install, pnpm add, yarn add, cargo add, go get, composer require, gem install, upgrade dependency, dependency upgrade, version bump, bump version, bump package, adding dependency, new dependency, vetting a dependency, vet package, is this package safe, safe to install, should I install, before installing, pre-install check, preinstall scan, preinstall-check, PyPI cooldown, npm cooldown, release cooldown, minimumReleaseAge, score a package, package score, depscore, socket score, supply chain, supply chain attack, malicious package, poisoned dependency, npm worm, Shai-Hulud, behavioural scanning, Socket.dev, socket scan, dependency security, postinstall malware, OIDC token theft, compromised maintainer, typosquat, dependency confusion, package provenance, SLSA, persistence hook, malicious VS Code extension.
testing
GitHub remote operations — repo creation, metadata (description/homepage/topics), releases, README 'Recent Updates' enforcement, and issue / PR management with preview-before-send discipline. Companion to git-ops (local) and push-gate (pre-push safety). Three modes: new (first publish), update (subsequent release), audit (read-only checklist), plus atomic operations for issues and PRs. Triggers on: push to github, publish repo, ship release, cut release, gh release, set topics, repo description, github metadata, recent updates section, audit github repo, repo visibility, make repo public, gh repo create, gh issue, gh pr, create issue, comment on issue, close issue, triage issue, create PR, review PR, merge PR, pre-merge check, pr checks.
tools
Defend the agent's instruction surface against adversarial content - hidden-Unicode prompt injection (Trojan Source bidi reordering, U+E0000 tag-block ASCII smuggling, zero-width text), homoglyph confusables, and poisoned context that a human reviewer can't see but the model obeys. Scan CLAUDE.md / AGENTS.md / SKILL.md / .cursorrules and MCP tool descriptions; sanitize fetched web pages, issue/PR bodies, and dependency READMEs before they enter context. Triggers on: prompt injection, hidden unicode, invisible characters, zero-width space, bidi override, Trojan Source, ASCII smuggling, tag characters, homoglyph, confusable, unicode steganography, poisoned CLAUDE.md, malicious tool description, MCP tool poisoning, instruction injection, jailbreak in file, is this file safe, sanitize untrusted content, scan for hidden text.
tools
Set tool permissions for Claude Code. Configures allowed commands, rules, and preferences in .claude/ directory. Triggers on: setperms, init tools, configure permissions, setup project, set permissions, init claude.