A command that runs the project’s complete automated checks and validates the plugin structure. It covers hooks, secret-detection patterns, file and manifest structure, and reference documentation.

Use it to run the full test suite or only the hook, secret, structure, or reference-documentation checks when diagnosing a failure.

It gathers many health checks in one run, making it easier to catch broken scripts, missing files, invalid configuration, and documentation problems before release.

test-all — Command by whchoi98

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add commands/whchoi98/project-init/test-all

Clone the repo

git clone --depth 1 https://github.com/whchoi98/project-init

Made for: Claude Code.

Per session 9 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 681 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00009	$0.00681
Opus 5	$0.00005	$0.00341
Sonnet 5	$0.00002	$0.00136
Haiku 4.5	$0.00001	$0.00068

Measured 2d ago against content hash 91725581aaae, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

test-all scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Unrestricted tool accessmediumExcessive agency

A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.

allowed-tools: Read, Bash(bash tests/*), Bash(bash -n:*), Bash(find:*), Bash(python3 -m json.tool:*), Bash(chmod:*), Bash(ls:*), Glob, Grep

.claude/commands/test-all.md · 79 lines

How it starts

The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Test All

Run the automated test suite and validate plugin health.

Step 1: Run Test Suite

Execute the harness test suite:

bash tests/run-all.sh

This runs 169 tests across 4 categories:

Hook tests (27): Syntax, permissions, registration, behavior
Secret pattern tests (22): True positive detection, false positive rejection
Structure tests (65): Manifests, version sync, file existence, CLAUDE.md content
Reference-doc tests (55): 8-layer template skeletons, INDEX/Code Pointer validation, sync-docs reference logic

Step 2: Analyze Results

If tests fail:

Read the failure messages for exact file paths and expected values
Hook failures: Check .claude/hooks/*.sh syntax and permissions
Pattern failures: Check regex in secret-scan.sh against test fixtures in tests/fixtures/
Structure failures: Check file existence and JSON validity

Step 3: Run Targeted Tests (if needed)

# Run only specific test category
bash tests/run-all.sh hooks        # Hook tests only
bash tests/run-all.sh secret       # Secret pattern tests only
bash tests/run-all.sh structure    # Structure tests only
bash tests/run-all.sh reference    # Reference-doc tests only

Step 4: Report

Present:

Total tests run, passed, failed, skipped
Failed test details with file paths and fix suggestions
If all pass, confirm project health is verified

Error Recovery

If test runner itself fails

# Check bash syntax of test runner
bash -n tests/run-all.sh

# Check if test files are executable
ls -la tests/hooks/test-*.sh tests/structure/test-*.sh

# Fix permissions if needed
chmod +x tests/**/*.sh

Common failure categories and fixes

Failure Pattern	Likely Cause	Fix
"file not found"	Missing file after restructure	Create the file or update the test
"invalid JSON"	Malformed manifest	`python3 -m json.tool <file>` to find syntax error
"Version mismatch"	marketplace.json ≠ plugin.json	Update both to same version
"not executable"	Permission reset by git	`chmod +x .claude/hooks/.sh scripts/.sh`
"bash syntax error"	Bad edit in hook script	`bash -n <file>` to locate error line
"pattern did not match"	Regex changed in secret-scan.sh	Update test patterns to match or fix the regex

Read the full file on GitHub · 79 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 79 lines · 9 tokens per session scan B 91725581aaae

Subscribe to this mod's changes

test-all is a command published in the GitHub repository whchoi98/project-init (2 stars, last pushed 1mo ago), licensed MIT. It adds 9 tokens to every session and 681 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it B with 1 finding (unrestricted tool access). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Testing

test-all