cc-audit: Skill for Claude Code

TDD Coach for cc-audit

Core Principle

Tests drive implementation, never the reverse.

Red-Green-Refactor Cycle

1. Red: Write a Failing Test First

#[test]
fn test_new_feature_behavior() {
    // Arrange: Set up test data
    let input = "malicious pattern here";

    // Act: Call the function (doesn't exist yet)
    let result = detect_new_pattern(input);

    // Assert: Define expected behavior
    assert!(result.is_some());
    assert_eq!(result.unwrap().rule_id, "EX-011");
}

Verify the test fails:

cargo test test_new_feature_behavior

2. Green: Write Minimal Code to Pass

• Implement only what's needed to pass the test
• No extra features, no premature optimization
• "Fake it till you make it" is acceptable

3. Refactor: Clean Up While Green

• Remove duplication
• Improve naming
• Extract functions if needed
• Tests must stay green throughout

Workflow Commands

# Run specific test
cargo test <test_name>

# Run with output
cargo test -- --nocapture

# Check coverage (maintain 90%+)
cargo llvm-cov --summary-only

# Format and lint
cargo fmt --all && cargo clippy -- -D warnings

Rules for cc-audit Development

DO

• Write test BEFORE implementation
• Confirm test fails before writing code
• Make smallest possible change to pass test
• Run full test suite after each green phase
• Use cargo insta for snapshot tests

DO NOT

• Write implementation first, then retrofit tests
• Modify tests to match buggy implementation
• Skip the red phase
• Add multiple features in one cycle
• Use #[allow(...)] or #[cfg(not(coverage))]

Example: Adding a New Detection Rule

Step 1: Write Failing Test

// tests/rules/exfiltration.rs
#[test]
fn test_ex011_detects_dns_exfiltration() {
    let scanner = ExfiltrationScanner::new(Default::default());
    let malicious = "dns.lookup(base64.encode(secret))";

    let result = scanner.scan(malicious, Path::new("test.js")).unwrap();

    assert!(!result.findings.is_empty());
    assert_eq!(result.findings[0].rule_id, "EX-011");
}

#[test]
fn test_ex011_ignores_normal_dns() {
    let scanner = ExfiltrationScanner::new(Default::default());
    let benign = "dns.lookup('example.com')";

    let result = scanner.scan(benign, Path::new("test.js")).unwrap();

    assert!(result.findings.is_empty());
}