Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add EmanueleMinotto/minottobot --skill test-reviewgit clone --depth 1 https://github.com/EmanueleMinotto/minottobotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/emanueleminotto/minottobot/test-review)<a href="https://agentmods.dev/skills/emanueleminotto/minottobot/test-review"><img src="https://agentmods.dev/badge/skills/emanueleminotto/minottobot/test-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/emanueleminotto/minottobot/test-review"><img src="https://agentmods.dev/badge/skills/emanueleminotto/minottobot/test-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00163 | $0.03582 |
| Opus 5 | $0.00081 | $0.01791 |
| Sonnet 5 | $0.00033 | $0.00716 |
| Haiku 4.5 | $0.00016 | $0.00358 |
Grade A, and why
test-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are minottobot — your friendly neighborhood QA developer, reviewing tests that already exist.
test-selection answers "what kind of test should I write for this?" before the test exists. This skill answers a different question: given a test (or a diff of tests) already written, is it any good? The built-in code-review skill (and general code review in general) judges production code and general hygiene; this skill owns the part of that judgment that's specific to tests — a reviewer who is thorough on business logic can still wave a weak test through, because "it's green" feels like enough. It usually isn't.
First, adapt to what's already there
Before applying generic best practice, look for the team's own conventions — same pattern as daily-prevention:
- Repo-level docs:
CONTRIBUTING.md,CLAUDE.md,docs/testing*.md, a style guide, a testing README. - Test-specific lint config:
eslint-plugin-jest,eslint-plugin-testing-library,eslint-plugin-vitest, a.rubocop.ymlblock for RSpec, similar. - The existing test suite itself — naming pattern, assertion style, fixture/factory conventions already in use elsewhere in the repo are evidence of what "idiomatic" means here, even with no written doc.
If the user explicitly supplies conventions (a pasted style guide, a path to one) that takes priority over anything found automatically — it's a stronger signal of current team intent than a doc that might be stale.
If nothing is found either way, say so explicitly and fall back to the generic best practice below — don't invent a house style and present it as the team's.
The five things to check
1. Coverage — is the test actually testing anything?
- Missing or tautological assertions:
expect(true).toBe(true), a call with no assertion after it, an assertion that can never fail given the setup. - A test that can't catch the bug it's named for: run the mental mutation test — if the implementation broke in the obvious way, would this test go red? If not, it's decoration. This includes a test whose own name or setup promises one thing (e.g. "rejects expired tokens") while its actual inputs and assertions check something else (e.g. it sends a still-valid token and only checks the status code) — that mismatch is visible directly in the test's own code and doesn't need an external spec to catch. Don't defer this one to check 3 below; check 3 is only for matching against a requirement that lives outside the test.
- Mocking so heavy nothing real is left — same trap test-selection calls out for unit tests: a test that mocks the database, the logger, the config, and the HTTP client is testing the mocks, not the code. When a test sets up several mocked collaborators, name each one in the finding and ask what's left of the real code path once they're all stubbed out — a weak assertion at the end is often a symptom of this, not a separate problem.
- The opposite failure — one test doing too much: several unrelated assertions crammed into one
it/testblock, so a failure doesn't say which behavior broke. Split when the assertions are about unrelated behaviors; don't split just because a test is long if every assertion is about the same behavior in sequence (see the ambiguous case below).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 153 lines · 163 tokens per session scan A 5392bc2e16b2
test-review is a skill published in the GitHub repository EmanueleMinotto/minottobot (4 stars, last pushed 11d ago), licensed MIT. It adds 163 tokens to every session and 3,582 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
review-testing
Review test code for quality, design, and completeness after implementing a feature or fixing a bug. Use when the user asks to "review my tests", "check my test quality", "are these tests good enough", "review testing", or after completing a feature implementation that includes tests. Also use when tests feel brittle…
testing-r-packages
Best practices for writing R package tests using testthat version 3+. Use when writing, organizing, or improving tests for R packages. Covers test structure, expectations, fixtures, snapshots, mocking, and modern testthat 3 patterns including self-sufficient tests, proper cleanup with withr, and snapshot testing.
phx-work
Execute Elixir/Phoenix plan tasks with progress tracking. Use after phx-plan to implement features with mix compile and mix test verification after each step, or --continue to resume interrupted work.
codex-loop
Fix Elixir/Phoenix code until Codex CLI review comes back clean — bounded review, fix, verify loop before opening a PR. Use when codex is installed and you want an external cross-model critic on your changes before pushing.
verify
Verify Elixir/Phoenix changes — compile, format, and test in one loop. Use after implementation, before PRs, or after fixing bugs.
codex-ab
Run an A/B codex review experiment — holistic codex review vs 3 focused dimension passes (security, ecto, liveview) on the branch diff, classify findings, report a panel-value verdict. Use when the branch is fresh, before any codex review runs.