skills/team/test-scaffold/SKILL.md
Test generation conventions, naming patterns, mock strategies, and project structure for .NET test suites. Use when generating tests for C#/.NET projects with xUnit, FluentAssertions, and NSubstitute.
npx skillsauth add michaelalber/ai-toolkit test-scaffoldInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
"The ratio of time spent reading versus writing code is well over 10 to 1. Tests should be the most readable code in the project." -- Robert C. Martin
This skill provides the conventions, patterns, and structural guidance for generating .NET test suites with xUnit, FluentAssertions, and NSubstitute: test naming, file organization, mock strategy, the AAA (Arrange-Act-Assert) structure, and test project setup. Apply these conventions consistently across every generated test. Tests are documentation of behavior — they must be the most readable code in the project, isolated, deterministic, and independent of execution order.
Non-Negotiable Constraints:
MethodName_Scenario_ExpectedResult, a complete sentence describing what is tested.IDENTIFY The unit under test (handler, validator, service, endpoint, pipeline behavior) and the
scenarios to cover: happy path, not-found, validation, exception, guard clause, edge,
state change, side effect.
CHOOSE The test type per scenario (decision table in references/test-patterns.md):
unit + mocks · validator TestValidate() · WebApplicationFactory integration ·
InMemory DbContext · mocked RequestHandlerDelegate for behaviors.
SCAFFOLD Place the test file mirroring src/ structure (naming-conventions.md). Write each test
AAA-structured, named MethodName_Scenario_ExpectedResult. Build data with builders;
mock only external boundaries (mock-patterns.md); use InMemory DbContext, not a mocked one.
VERIFY dotnet test passes; each test isolated and order-independent; no testing of private
methods or framework code; DbContext disposed; no hardcoded GUIDs/dates.
Exit criteria: every identified scenario has an AAA-structured, correctly named, isolated test;
the right test type per scenario; mocks limited to external boundaries; dotnet test green.
<test-scaffold-state>
phase: IDENTIFY | CHOOSE | SCAFFOLD | VERIFY | COMPLETE
unit_under_test: [class/member]
scenarios: [count identified]
tests_written: [count]
test_types: [unit | validator | integration | behavior | db]
build_status: pass | fail | not-run
last_action: [description]
next_action: [description]
</test-scaffold-state>
references/test-patterns.md.references/mock-patterns.md.references/naming-conventions.md.| Skill | Relationship |
|-------|-------------|
| tdd | The RED phase writes a failing test first; this skill supplies the conventions, naming, and structure those tests follow. |
| tdd-agent / tdd-pair | Operating modes of the TDD loop that generate tests — they apply these scaffolding conventions. |
| dotnet-vertical-slice | Scaffolds the feature handlers/validators/endpoints this skill writes tests for; the test tree mirrors the slice structure. |
| evaluate-tests | Audits generated tests for TDD discipline and quality — run it after scaffolding to verify the suite. |
development
Federal / government security overlay applied ON TOP OF a base language security review (dotnet/python/php/rust/react). Language-agnostic: adds NIST SP 800-53 control mapping, FIPS 140-2/3 cryptographic compliance (with a per-language crypto table), CUI handling, EO 14028 supply-chain requirements, and DOE Order 205.1B, and emits POA&M-ready findings with FIPS 199 impact levels. Use for federal/DOE/DOD/national-laboratory systems. Triggers on "federal security review", "NIST compliance", "NIST 800-53", "FISMA", "CUI", "FIPS audit", "DOE security", "POA&M", "ATO review". Do NOT use alone — run the matching <lang>-security-review FIRST; this overlay maps and extends it.
tools
OWASP-based security review of React / TypeScript front-end applications. Detects the framework (Vite/CRA/Next), entry points, and data flows, scans against the OWASP Top 10 (2025) mapped to React client-side patterns (XSS via raw HTML, URL/protocol injection, secrets in the bundle, insecure token storage, dependency CVEs, missing CSP, open redirects), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit React code for vulnerabilities. Triggers on "react security review", "frontend security audit", "audit react for vulnerabilities", "owasp react", "react xss", "react security posture", "npm audit review". For federal / gov / DOE / NIST / FIPS / CUI context, run security-review-federal after this base review. Do NOT use to grade architecture/structure — use react-architecture-checklist.
tools
Analyzes legacy React codebases and produces actionable modernization plans. Primary migration paths include class components to function components + hooks, Create React App to Vite, React 16/17 to 18 to 19, JavaScript to TypeScript, Enzyme to React Testing Library, legacy Redux to Redux Toolkit / Zustand / Context, and deprecated lifecycle/API removal. Does NOT perform the migration — assesses, quantifies risk, and plans. Triggers on phrases like "modernize react", "class to hooks", "upgrade react", "migrate CRA to vite", "react legacy migration", "react 17 to 18", "react js to typescript", "react technical debt", "enzyme to RTL".
development
Scaffolds feature-based React / TypeScript architecture using feature folders, presentational + container components, custom hooks, a typed data layer, and structural CQRS (query hooks vs mutation hooks). React analog of dotnet-vertical-slice and python-feature-slice — no DI framework; uses props/context for dependency injection and a query cache for server state. Use when creating feature-based React projects, adding React features, organizing components by feature rather than by technical type, or scaffolding a feature's data layer. Triggers on phrases like "scaffold react feature", "create react slice", "react feature folder", "react vertical slice", "add react feature", "react feature architecture", "organize react by feature".