Borrowing it
Nothing to install: this file belongs to T-rav/hydraflow. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/T-rav/hydraflow/staging/.codex/skills/hf.audit-tests/SKILL.mdgit clone --depth 1 https://github.com/T-rav/hydraflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/t-rav/hydraflow/hf.audit-tests)<a href="https://agentmods.dev/skills/t-rav/hydraflow/hf.audit-tests"><img src="https://agentmods.dev/badge/skills/t-rav/hydraflow/hf.audit-tests.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00006 | $0.03240 |
| Opus 5 | $0.00003 | $0.01620 |
| Sonnet 5 | $0.00001 | $0.00648 |
| Haiku 4.5 | $0.00001 | $0.00324 |
Grade A, and why
hf.audit-tests scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 303 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Test Audit
Run a comprehensive test quality audit across the entire repo. Analyzes test naming, structure, factory usage, anti-patterns, coverage gaps, and flaky patterns. Creates GitHub issues for findings so HydraFlow can process them.
Instructions
-
Resolve configuration before doing anything else:
- Run
echo "$HYDRAFLOW_GITHUB_REPO"— if set, use it as the target repo (e.g.,owner/repo). If empty, rungit remote get-url originand extract theowner/reposlug (striphttps://github.com/prefix and.gitsuffix). - Run
echo "$HYDRAFLOW_GITHUB_ASSIGNEE"— if set, use it as the issue assignee. If empty, extract the owner from the repo slug (the part before/). - Use
hydraflow-planas the label for created issues. - Store resolved values as
$REPO,$ASSIGNEE,$LABEL.
- Run
-
Discover project structure:
- Use Glob to find all test files:
**/test_*.py,**/tests/conftest.py,**/tests/helpers.py - Exclude
.venv/,venv/,__pycache__/,node_modules/ - Also find all UI test files:
ui/src/**/*.test.jsx,ui/src/**/*.test.js - Count total test files and identify the test helper infrastructure
- Use Glob to find all test files:
-
Launch agents in parallel using
Taskwithrun_in_background: trueandsubagent_type: "general-purpose":- Agent 1: Test naming & structure — Checks naming conventions, 3As structure, single responsibility, and organization.
- Agent 2: Anti-patterns & flaky tests — Detects over-mocking, weak assertions, flaky patterns, and test isolation issues.
- Agent 3: Factory/fixture gaps & coverage — Finds missing factories, repeated setup, coverage gaps, and missing edge case tests.
-
Wait for all agents to complete.
-
After all finish, run
gh issue list --repo $REPO --label $LABEL --state open --search "test quality" --limit 200to show the user a final summary of all issues created.
Agent 1: Test Naming & Structure
You are a test quality auditor focused on naming and structure for the project at {repo_root}.
## Configuration
- GitHub repo: {REPO}
- Assignee: {ASSIGNEE}
- Label: {LABEL}
## Steps
### Phase 1: Read All Test Files
1. Use Glob to find all test files: tests/test_*.py, ui/src/**/*.test.jsx
2. Read each test file
### Phase 2: Audit Test Naming
3. Check every test function/method name against the convention:
- **Pattern**: `test_<method/feature>_<scenario>[_<expected_result>]`
- **Flag**: names < 3 words (e.g., `test_init`, `test_run`)
- **Flag**: generic names (test_1, test_something, test_basic)
- **Flag**: redundant "test" in name (test_user_test)
- **Flag**: names that don't describe what's being tested
For each violation, note: file path, line number, current name, suggested better name
### Phase 3: Audit 3As Structure (Arrange-Act-Assert)
4. For each test function, check:
- Is there clear separation of setup, execution, and verification?
- Is all arrange code before the act?
- Are all assertions after the act?
- Are phases mixed? (e.g., assertions interleaved with setup)
- Does setup dominate the test? (> 60% of lines are setup — push into factories/fixtures)
### Phase 4: Audit Single Responsibility
5. For each test, count assertions:
- Flag tests with > 3 assertions testing **different** attributes (related assertions on the same result are OK)
- Suggest splitting into focused tests
- Note tests with zero assertions (test does nothing useful)
### Phase 5: Audit Test Organization
6. Check file-level organization:
- Are test classes used to group related tests?
- Are tests organized to mirror source file structure?
- Are there test files > 500 lines that should be split?
- Are there test files with < 3 tests (too granular)?
### Phase 6: Create GitHub Issues
7. Check for duplicate GH issues first:
gh issue list --repo {REPO} --label {LABEL} --state open --search "<key terms>"
8. Create GH issues for NEW findings only, grouped by theme:
gh issue create --repo {REPO} --assignee {ASSIGNEE} --label {LABEL} --title "Test Quality: <theme>" --body "<details>"
## Issue Body Format
```markdown
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 303 lines · 6 tokens per session scan A 020e20353ead
hf.audit-tests is a skill published in the GitHub repository T-rav/hydraflow (5 stars, last pushed 2d ago), licensed Apache-2.0. It adds 6 tokens to every session and 3,240 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
debug
Run /debug to find and fix a bug's root cause: a test failing for an unclear reason, /check verify finding a failure, or behavior being wrong. Runs a reproduce, localize, hypothesize, test, fix, verify loop, makes the minimal fix, and hands a regression test to /test. No features, no extra refactors.
check
Confirm a change before merge. /check verify drives the real app to prove behavior against the spec (every acceptance criterion met, every surface built). /check review runs a senior code review on a fresh model, one that did not write the code. Verify after /develop, review before a PR. Writes to docs/reviews/, never…
holdout-validation
Cross-reference agent self-review claims against actual file state using hidden holdout scenarios, producing mapped P1/P2/P3 findings that reference visible acceptance criteria only. Use when verifying implementation completeness after self-review in start (Phase 4 VERIFY), address (convergence check), or review…
runtime-verification
Verify code works at runtime through build verification (mandatory), LSP diagnostics, ad-hoc verification for projects without frameworks, E2E and smoke tests, and visual verification (screenshot-analyze-verify for UI changes). Skip whitelist strictly enforced (markdown-only, config-only, dependency-bump-only with…
visual-verification
Verify UI-facing changes by running a screenshot-analyze-verify loop across configured viewports, with a browser-tool priority cascade (Playwright MCP → Chrome DevTools MCP → CLI fallback → external skill fallback) and bounded iteration. Use after build/runtime verification passes and the diff includes…
finding-reconciliation
Merge the independent A/B/C findings tables into one adjudicated ledger in 07-verification/documentation-verification-report.md — normalizing to the finding schema, deduplicating by location and claim, recording per-finding corroboration without downgrading single-pass findings, promoting cross-pass disagreement to…