Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/QBall-Inc/the-bulwarknpx agentmods add skills/qball-inc/the-bulwark/test-fixture-creationWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/qball-inc/the-bulwark/test-fixture-creation)<a href="https://agentmods.dev/skills/qball-inc/the-bulwark/test-fixture-creation"><img src="https://agentmods.dev/badge/skills/qball-inc/the-bulwark/test-fixture-creation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/qball-inc/the-bulwark/test-fixture-creation"><img src="https://agentmods.dev/badge/skills/qball-inc/the-bulwark/test-fixture-creation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.02157 |
| Opus 5 | $0.00030 | $0.01078 |
| Sonnet 5 | $0.00012 | $0.00431 |
| Haiku 4.5 | $0.00006 | $0.00216 |
Grade C, and why
test-fixture-creation scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf scripts/components/ How it starts
The opening of the file, as written. The whole thing — 304 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Test Fixture Creation
Guidelines for creating test fixtures that work with Bulwark's hook-based automation and avoid bias that could compromise testing.
When to Use This Skill
Load this skill when:
- Creating fixtures for manual testing of skills or agents
- Setting up E2E test scenarios that require hook automation
- Building code samples with deliberate issues for LLM review
DO NOT use for:
- Unit test fixtures (those can be isolated in tests/fixtures/)
- Mock data for automated tests
- Documentation examples
Core Principles
1. No Bias in Fixtures
CRITICAL: Fixtures must not contain any indicators that they are test fixtures.
| Forbidden | Why | Alternative |
|---|---|---|
test-*.ts, *-fixture.ts |
Filename reveals intent | user-service.ts, data-processor.ts |
// This is a test file |
Comment reveals intent | No explanatory comments |
// Intentional bug here |
Points to the issue | Let LLM discover it |
fixture/, test-data/ |
Directory name reveals intent | scripts/components/, lib/ |
FIXME, TODO: test |
Markers reveal intent | Remove all markers |
Why this matters: When Claude knows code is a test fixture, it may:
- Skip hook automation ("this is just a test")
- Ignore pipeline suggestions
- Produce different results than real code review
2. Project Infrastructure Integration
Fixtures must be placed within project infrastructure to enable hook automation.
Required for hooks to fire:
- Code must be in directories covered by
tsconfig.jsoninclude paths - Project must have working
just typecheckandjust lintrecipes - Fixtures must pass Phase 1 checks
Placement Strategy:
PROJECT_ROOT/
├── scripts/
│ ├── components/ ← Place fixtures here
│ │ ├── user-service.ts
│ │ ├── data-processor.ts
│ │ └── workflow-handler.ts
│ └── lib/ ← Supporting stubs
│ ├── database.ts
│ └── logger.ts
3. Fixtures Must Pass Phase 1
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 304 lines · 61 tokens per session scan C c67723ad1f41
test-fixture-creation is a skill published in the GitHub repository QBall-Inc/the-bulwark (8 stars, last pushed yesterday), licensed MIT. It adds 61 tokens to every session and 2,157 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
journey-simulation
Use when caller wants to observe how a stranger encounters a flow, artifact, or sandbox — triggers like "simulate a user journey", "test our onboarding / checkout / signup", "will my ICP convert", "how does a cold reader experience this README", "first-time user test", "cognitive walkthrough", or any request to…
add-integration-test
Use when a ticket asks for integration or end-to-end coverage across components — an API route hitting a database, a service-to-service call, a multi-step flow — rather than a single unit. Invoke for "test the endpoint end to end", "cover the checkout flow", or "verify the migration + query together".
test-native-extension
Validate a third-party control repo across four automated layers plus one printed manual recipe. Layer 1 asserts native-source structure (Android getName() and iOS +moduleName to manifest nativeModule; @ReactMethod / RCTEXPORTMETHOD to methods; no @ReactModule) plus load/init readiness (ReactPackage public no-arg…
test-site
Tests a deployed, activated Power Pages site at runtime using browser-based navigation, page crawling, and API request verification via Playwright. Use when the user wants to test, verify, or smoke-test their deployed site.
symfony:functional-tests
Write functional tests for Symfony controllers and HTTP endpoints using WebTestCase, getContainer, loginUser, and DAMA rollback.
symfony:e2e-panther-playwright
Write end-to-end tests with Symfony Panther 2.4 for browser automation or Playwright for complex scenarios.