Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/arcblock/agent-skills/test-auditnpx skills add ArcBlock/agent-skills --skill test-auditgit clone --depth 1 https://github.com/ArcBlock/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arcblock/agent-skills/test-audit)<a href="https://agentmods.dev/skills/arcblock/agent-skills/test-audit"><img src="https://agentmods.dev/badge/skills/arcblock/agent-skills/test-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00167 | $0.03436 |
| Opus 5 | $0.00084 | $0.01718 |
| Sonnet 5 | $0.00033 | $0.00687 |
| Haiku 4.5 | $0.00017 | $0.00344 |
Grade A, and why
test-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 232 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Test Audit
A test suite has one job: go red when the code is wrong. This skill looks for the places it cannot do that.
Repo profile. The engine here is repo-agnostic. Every repo fact — scan surface, assertion dialect, per-rule severity, how to run a subset of tests — comes from an adapter at
.claude/test-audit.config.tsin the consuming repo. Arc is the reference implementation.
Usage
# One PR / working tree: what did this change do to the suite?
bun <plugin_root>/skills/test-audit/scripts/audit.ts diff [--base origin/main] [--json]
# Whole tree: which tests verify nothing? (advisory backlog, never a gate)
bun <plugin_root>/skills/test-audit/scripts/audit.ts scan [--json] [--rule <id>]
bun <plugin_root>/skills/test-audit/scripts/audit.ts scan --write-baseline
# Turn a sweep into a handful of actionable issue drafts (prints; never creates)
bun <plugin_root>/skills/test-audit/scripts/audit.ts issues [--rule <id>] [--json]
# Calibration: what would these rules have done to real merged history?
bun <plugin_root>/skills/test-audit/scripts/replay.ts [--limit 300] [--rule <id>] [--verbose]
issues groups findings by (rule × owning unit), gives each draft the four
blocks a work item needs (问题 / 证据 / 方案 / 验收) and a test-audit-key
marker for upsert, and rolls the long tail of one-off groups into a single
per-rule list. On arc that turns 108 findings into 17 drafts. It prints and
exits — creating issues is a side effect on a shared surface and stays an
explicit act by whoever ran it.
When invoked — pick the mode, then read the output
There are four modes and they answer different questions. Choose from what was actually asked; do not run all of them.
| What you were asked | Mode | Then |
|---|---|---|
"review this PR's tests" / a PR number / you are inside pr-review |
diff --base <merge-base> |
Read the gate row first. In a repo where this is wired as a verification check (arc: testQuality), pre-merge already ran it — quote that row rather than re-running. Only run it yourself when there is no such row. |
| "what's wrong with our tests" / "sweep" / "backlog" | scan |
Report the NEW-vs-baseline split, not the raw total. The baseline is accepted debt; re-announcing it every time is how a report becomes wallpaper. |
| "file issues for this" | issues |
Print the drafts. Add --create --repo <owner/name> only if the human asked for issues to be created — the flag is the authorisation, and it is never inferred. |
| "should rule X block?" / "is this rule any good?" | replay --rule X --verbose |
Read the hits. A rule earns block only with a demonstrated true positive and a near-zero false-positive rate on that history. |
What ships with it
25 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- fixtures/assertion-weakened/bad-after.fixture.ts 417 B runs code
- fixtures/assertion-weakened/before.fixture.ts 598 B runs code
- fixtures/assertion-weakened/good-after.fixture.ts 1.4 KB runs code
- fixtures/catch-swallow/bad.fixture.ts 405 B runs code
- fixtures/catch-swallow/good.fixture.ts 2.0 KB runs code
- fixtures/empty-catch/bad.fixture.ts 452 B runs code
- fixtures/empty-catch/good.fixture.ts 1.3 KB runs code
- fixtures/no-assertions/bad.fixture.ts 223 B runs code
- fixtures/no-assertions/good.fixture.ts 2.5 KB runs code
- fixtures/only/bad.fixture.ts 240 B runs code
- fixtures/only/good.fixture.ts 138 B runs code
- fixtures/test-disabled/bad-after.fixture.ts 298 B runs code
- fixtures/test-disabled/before.fixture.ts 181 B runs code
- fixtures/test-disabled/good-after.fixture.ts 268 B runs code
- fixtures/test-removed/bad-after.fixture.ts 331 B runs code
- fixtures/test-removed/before.fixture.ts 293 B runs code
- fixtures/test-removed/good-after.fixture.ts 447 B runs code
- scripts/adapter.ts 7.2 KB runs code
- scripts/audit.ts 11 KB runs code
- scripts/diff.ts 14 KB runs code
- scripts/issues.ts 14 KB runs code
- scripts/replay.ts 4.7 KB runs code
- scripts/rules.ts 22 KB runs code
- test/issues.test.ts 4.9 KB runs code
- test/rules.test.ts 6.2 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 232 lines · 167 tokens per session scan A aba1cdcc26d1
test-audit is a skill published in the GitHub repository ArcBlock/agent-skills (5 stars, last pushed 3d ago), licensed MIT. It adds 167 tokens to every session and 3,436 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…