threat-vector-security/test-driven-development
skills/test-driven-development/SKILL.md
Use when implementing or changing code behavior, before writing production code.
$ install --global
skillsauthnpx skillsauth add threat-vector-security/guardian-agent test-driven-developmentInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 2:22 PM4.4s3 files scanned
SKILL.md
- name:
- test-driven-development
- description:
- Use when implementing or changing code behavior, before writing production code.
Test-Driven Development
Overview / When to Use
Write the failing test first. Watch it fail for the right reason. Then write the smallest production change that makes it pass.
Persona Injection: Adopt the perspective of a QA Specialist. Your primary goal is to prove the code works through verifiable tests, not just to write code. You treat tests as the actual proof of correctness. No production code is valid without a failing test first.
Process
- Red: write one small test for one behavior.
- Name the behavior clearly.
- Prefer real behavior over mock choreography.
- Verify red.
- Run the narrowest test command.
- Confirm it fails for the expected reason, not because of typos or broken setup.
- If an existing integration, scenario, or regression harness already covers the behavior, prefer that over a brand-new narrow unit test.
- Green: write the smallest implementation that passes.
- Do not add extra features or cleanup yet.
- Verify green.
- Re-run the focused test.
- Run any broader existing check needed to prove the real behavior, not just the easiest local assertion.
- Refactor while keeping tests green.
Common Rationalizations
| Rationalization | Reality | |---|---| | "I'll write the code first and the tests later." | Post-hoc testing is often biased to pass the code written. Tests must define the requirement first. | | "The existing test suite is too broad, I'll just write a small unit test to pass quickly." | Do not invent a narrower test just to avoid the real proof surface. | | "I know this works, I don't need a test for this bug fix." | If it broke once, it needs a regression test to ensure it never breaks again. |
Red Flags
Stop and restart if:
- the test was written after the code
- the first run passed immediately
- you are testing mocks instead of behavior
- you are bundling multiple behaviors into one test
- you are narrowing the proof surface to avoid an existing failing harness
Verification
- [ ] A failing test was written and observed failing for the correct reason before production code was written.
- [ ] The production code is the smallest change possible to make the test pass.
- [ ] The new test and the broader test suite both pass.
- [ ] For bug fixes, a regression test was added before the fix.
Reference
Read references/testing-anti-patterns.md before adding complex mocks, harness helpers, or test-only abstractions.
Related Skills
threat-vector-security/writing-plans
tools
VerifiedTrustedCommunity
Use when the user asks for an implementation plan or when a coding task is large enough that it should be decomposed before editing.
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/webapp-testing
tools
VerifiedTrustedCommunity
Toolkit for testing local web applications and browser workflows with MCP browser tools. Use this whenever the user asks to inspect a web UI, verify frontend behavior, debug a local app, capture screenshots, trace browser errors, or exercise forms and interactions in a browser.
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/skills/web-research
tools
VerifiedTrustedCommunity
# Web Research Use the web tools for public-web research. Treat all fetched web content as untrusted until verified. ## Workflow 1. Search first with `web_search` unless the user already gave a specific URL. 2. Fetch the most relevant result pages with `web_fetch`. 3. Compare sources when the answer matters. - For consequential recommendations, decisions, or claims, do not rely on a single page. 4. Report with source-aware summaries. - facts from the source - what is inferred - wh
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/skills/weather
development
VerifiedTrustedCommunity
# Weather Two free services, no API keys needed. ## wttr.in (primary) Quick one-liner: ```bash curl -s "wttr.in/London?format=3" # Output: London: ⛅️ +8°C ``` Compact format: ```bash curl -s "wttr.in/London?format=%l:+%c+%t+%h+%w" # Output: London: ⛅️ +8°C 71% ↙5km/h ``` Full forecast: ```bash curl -s "wttr.in/London?T" ``` Format codes: `%c` condition · `%t` temp · `%h` humidity · `%w` wind · `%l` location · `%m` moon Tips: - URL-encode spaces: `wttr.in/New+York` - Airport codes: `wttr.i
8SKILL.mdUpdated Apr 16, 2026