Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rianvdm/product-ai-public --skill workers-vitest-poolgit clone --depth 1 https://github.com/rianvdm/product-ai-publicWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rianvdm/product-ai-public/workers-vitest-pool)<a href="https://agentmods.dev/skills/rianvdm/product-ai-public/workers-vitest-pool"><img src="https://agentmods.dev/badge/skills/rianvdm/product-ai-public/workers-vitest-pool/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rianvdm/product-ai-public/workers-vitest-pool"><img src="https://agentmods.dev/badge/skills/rianvdm/product-ai-public/workers-vitest-pool.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 159 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00120 | $0.03140 |
| Opus 5 | $0.00060 | $0.01570 |
| Sonnet 5 | $0.00024 | $0.00628 |
| Haiku 4.5 | $0.00012 | $0.00314 |
Grade A, and why
workers-vitest-pool scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 284 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Workers vitest pool: known-good setup + v2→v4 upgrade recipe
Amazon's @cloudflare/vitest-pool-workers had a long-lived bug in the 0.5.x line where the per-test storage isolation snapshot asserts every persist file ends in .sqlite, but SQLite-backed Durable Objects in WAL mode produce .sqlite-shm and .sqlite-wal files alongside. The bug manifests as:
Failed to pop isolated storage stack frame in <test name>'s test "<...>".
In particular, we were unable to pop Durable Objects storage.
- AssertionError [ERR_ASSERTION]: Expected .sqlite, got .../foo.sqlite-shm
Upstream fix landed in @cloudflare/[email protected], which requires vitest 4 and Node 22+. This skill captures the canonical setup and the migration recipe — battle-tested in tldl (PR #39, 2026-05-02).
When to use this skill
- Scaffolding tests in a new Worker. Use the "Known-good setup" section to pin the modern stack from day one.
- An existing Worker is on pool-workers
0.5.x/0.6.x/0.7.x/0.8.x/0.9.x/0.10.x/0.11.x/0.12.x. Even if tests appear to pass, the bug is latent — any test that uses a SQLite-backed Durable Object will hit it eventually. Run the migration. - Tests are reporting "Isolated storage failed" or "Expected .sqlite, got .sqlite-shm". That is exactly this bug.
Known-good setup (use this for new projects)
// package.json — devDependencies
{
"@cloudflare/vitest-pool-workers": "^0.15",
"@cloudflare/workers-types": "^4",
"@types/node": "^22",
"typescript": "^5",
"vitest": "^4",
"wrangler": "^4"
}
// tsconfig.json — types entry
{
"compilerOptions": {
"types": [
"@cloudflare/workers-types",
"@cloudflare/vitest-pool-workers/types", // ← /types subpath, not bare
"node"
]
}
}
// vitest.config.ts — v4 shape
import { cloudflareTest, readD1Migrations } from "@cloudflare/vitest-pool-workers";
import { defineConfig } from "vitest/config";
import path from "node:path";
const migrations = await readD1Migrations(path.join(import.meta.dirname, "migrations"));
export default defineConfig({
plugins: [
cloudflareTest({
wrangler: { configPath: "./wrangler.toml" },
miniflare: {
bindings: {
// test-only env vars + secret stand-ins
},
},
}),
],
test: {
provide: { DB_MIGRATIONS: migrations },
},
});
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 284 lines · 120 tokens per session scan A 3280a4f81297
workers-vitest-pool is a skill published in the GitHub repository rianvdm/product-ai-public (16 stars, last pushed 3d ago), licensed MIT. It adds 120 tokens to every session and 3,140 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
migrate-xunit-to-xunit-v3
Migrate .NET test projects from xUnit.net v2 to xunit.v3 and fix v3 breaks. Use for package/CPM conversion, OutputType=Exe, preserving the VSTest or MTP runner (including projects currently using YTest.MTP.XUnit2), incompatible TFMs, async void tests, string-to-Type attributes, custom Fact/Theory/BeforeAfterTest…
go-testing
Trigger: Go tests, go test coverage, Bubbletea teatest, golden files. Apply focused Go testing patterns.
nw-fp-clojure
Clojure language-specific patterns, data-first modeling, REPL-driven development, and spec.
mobiai-ios-testing
Use when writing or running tests in an iOS project — unit tests, UI tests, snapshot tests, choosing the right framework.
junit-5-skill
Generates production-grade JUnit 5 unit and integration tests in Java. Covers assertions, parameterized tests, lifecycle hooks, mocking with Mockito, and nested tests. Use when user mentions "JUnit", "JUnit 5", "@Test", "assertEquals", "Assertions", "Java unit test". Triggers on: "JUnit", "@Test", "assertEquals"…
restore-internals-seams-in-finally-blocks-after-each-test
When delegating a task affected by this skill, include.