Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ApexIQ/skillsmith --skill testing_backend_best_practicesgit clone --depth 1 https://github.com/ApexIQ/skillsmithWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/apexiq/skillsmith/testing_backend_best_practices)<a href="https://agentmods.dev/skills/apexiq/skillsmith/testing_backend_best_practices"><img src="https://agentmods.dev/badge/skills/apexiq/skillsmith/testing_backend_best_practices.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.00460 |
| Opus 5 | $0.00013 | $0.00230 |
| Sonnet 5 | $0.00005 | $0.00092 |
| Haiku 4.5 | $0.00003 | $0.00046 |
Grade A, and why
backend-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
🧪 Backend Testing Standards
Philosophy: Untested code is broken code.
1. The Testing Pyramid
| Type | Coverage | Speed | Purpose |
|---|---|---|---|
| Unit | 70% | ⚡ Fast | Test individual functions/classes. |
| Integration | 20% | 🐢 Medium | Test API endpoints + Database. |
| E2E | 10% | 🐌 Slow | Full flows (Login -> Dashboard). |
2. Tooling
- Runner:
pytest. - Fixtures: Use
conftest.pyfor shared setup (DB sessions, users). - Mocking:
unittest.mockorpytest-mockfor external APIs.
3. Rules of Engagement
Rule 1: Isolation
Every test gets a fresh DB transaction that is rolled back after the test.
Rule 2: Scoping (Critical for Security)
Always create 2 users (user_a, user_b). Ensure A cannot access B's data.
def test_user_cannot_access_other_users_item(client, user_a_auth, user_b_item):
response = client.get(f"/items/{user_b_item.id}", headers=user_a_auth)
assert response.status_code == 404 # Must be 404, not 403
Rule 3: Deterministic Data
- Do not assume
ID=1. Use the object's.idafter creation. - Use fixed dates (e.g.,
datetime(2026, 1, 1)) in tests.
Examples
- Testing a new endpoint: Create fixtures -> Call endpoint -> Assert response + DB state.
Guidelines
- Run tests before every commit.
- If a bug is found, write a failing test first before fixing.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 55 lines · 25 tokens per session scan A 67b8620028f1
backend-testing is a skill published in the GitHub repository ApexIQ/skillsmith (5 stars, last pushed 5mo ago), licensed MIT. It adds 25 tokens to every session and 460 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
unit-test
Testing patterns for the Python/FastAPI + React/TypeScript stack. Covers pytest configuration, conftest fixtures, database safety guards, external API mocking, async tests, Celery eager mode, and Vitest for frontend.
nw-fp-domain-modeling
Domain modeling with algebraic data types, smart constructors, and type-level error handling.
nw-fp-hexagonal-architecture
Hexagonal architecture patterns with pure core and side-effect shell for functional codebases.
csharp-dotnet
Use when writing, reviewing, testing, or shipping C# / .NET code — ASP.NET Core APIs (minimal APIs vs controllers), EF Core data access, async correctness, solution layout in .cs/.csproj/.sln. NOT a Java/Spring backend (that is spring-boot), NOT a Node/TypeScript backend (that is nestjs), NOT framework-neutral REST…
qa-api-testing-contracts
API contract testing across REST, GraphQL, gRPC, AsyncAPI, webhooks, and workflow contracts. Use when you need schema validation, breaking-change detection, and CI quality gates.
nestjs
Use when building or structuring a NestJS backend — feature modules, providers and DI wiring, provider scopes and request-lifecycle order, where to bind guards/pipes/interceptors/filters, and testing with Test.createTestingModule. NOT a bare Express/Fastify service with no DI (that is nodejs), NOT framework-agnostic…