dxkit-test

dxkit-test is a skill for Claude Code from vyuh-labs/dxkit. It costs 103 tokens per session (1,802 once invoked), scanned A, original, MIT.

A coding skill that finds important parts of a codebase without tests and writes tests for them. It uses the repository's existing test tools and patterns.

In plain words
What is it for?
Use it to add missing tests, run the test suite and coverage checks, and confirm that the new tests exercise meaningful behavior.
Why use it?
It helps prevent tests that only increase coverage numbers without checking real behavior. It focuses testing effort on untested code where failures would affect more of the system.

Skill for Claude Code

Written for Claude Code: installed under .claude/.

Good fit Use it to add missing tests, run the test suite and coverage checks, and confirm that the new tests exercise meaningful behavior.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/vyuh-labs/dxkit/dxkit-test
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add vyuh-labs/dxkit --skill dxkit-test
Clone the repo
git clone --depth 1 https://github.com/vyuh-labs/dxkit

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for dxkit-test

README.md
[![agentmods](https://agentmods.dev/badge/skills/vyuh-labs/dxkit/dxkit-test/github.svg)](https://agentmods.dev/skills/vyuh-labs/dxkit/dxkit-test)
Your own site
<a href="https://agentmods.dev/skills/vyuh-labs/dxkit/dxkit-test"><img src="https://agentmods.dev/badge/skills/vyuh-labs/dxkit/dxkit-test/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for dxkit-test

Your own site · 80×15
<a href="https://agentmods.dev/skills/vyuh-labs/dxkit/dxkit-test"><img src="https://agentmods.dev/badge/skills/vyuh-labs/dxkit/dxkit-test.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 103 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,802 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 8 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium MCP Rug Pull · line 36
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 57
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 58
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 95
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 96
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 110
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 122
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 123
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00103 $0.01802
Opus 5.5 $0.00041 $0.00721
Sonnet 5.5 $0.00021 $0.00360
Haiku 4.5 $0.00010 $0.00180

Measured 1mo ago against content hash 779d2a2afaf3, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

dxkit-test scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

src-templates/.claude/skills/dxkit-test/SKILL.md · 154 lines

How it starts

The opening of the file, as written. The whole thing — 154 lines — stays where its author put it; the contents beside it link to each section on GitHub.

dxkit-test

This skill closes the gap dxkit-action doesn't: it writes the missing tests rather than fixing flagged findings. It is the testing mirror of dxkit-docs — same shape, different dimension. It's built around one hard constraint: a test that doesn't actually exercise behavior (an empty expect(true), a snapshot of nothing, a call with no assertion) raises the coverage number while proving nothing. The whole point of this skill is tests that are grounded in real behavior and catch real regressions — not coverage theater.

The testing loop

[1] Read the gap   → test-gaps: the blast-radius-weighted untested worklist
[2] Orient         → graph: what the file does, who depends on it, what to assert
[3] Generate       → write real tests in the repo's framework + patterns
[4] Verify         → run the suite + coverage; Tests up, nothing red
[5] Guardrail      → guardrail check before pushing

Don't skip [2] or [4]. [2] is what makes the tests meaningful; [4] is what proves they pass and the coverage actually moved.

[1] Read the gap — what's actually untested, worst-first

Run the test-gaps report with graph context so the worklist is ranked by blast radius (how many files depend on each untested file), not just size:

npx vyuh-dxkit test-gaps --detailed --graph-context
npx vyuh-dxkit test-gaps --detailed --graph-context --json | jq '.actions, .gaps[0:10]'

The report partitions untested files into CRITICAL / HIGH / MEDIUM / LOW risk tiers, and within each tier the most-depended-on files surface first (the Graph context column shows role · N caller files). Work top-down: a 30-caller untested file is a bigger liability than a 500-line leaf nothing calls. The actions array names the top-K per tier with projected score uplift — that's your queue.

A blast radius n/a cell means graphify couldn't resolve that language's call graph (C# is the known case) — treat it as unknown, not "no callers," and fall back to the file's role + size to judge its risk.

Read the full file on GitHub · 154 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 154 lines · 103 tokens per session scan A 779d2a2afaf3

Subscribe to this mod's changes

dxkit-test is a skill published in the GitHub repository vyuh-labs/dxkit (10 stars, last pushed 1mo ago), licensed MIT. It adds 103 tokens to every session and 1,802 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

Code Coverage Analysis

Measure and enforce test coverage with Istanbul/nyc, c8, Jest, and Vitest. Covers branch versus line coverage, per-directory thresholds, CI gates, and correctly excluding generated code from reports.

PramodDutta/qaskills · 45 tokens

specflow

Spec-driven development with executable contracts.

Hulupeep/Specflow · 9 tokens

specflow-simulate

Simulates end-to-end usage of a Specflow story across multiple personas and divergent routes to discover gaps, edge cases, and unhandled branches BEFORE the story is built — then proposes each finding as a concrete story addition (new REQ, negative-path AC, Gherkin branch, or journey step). This is the high-value…

Hulupeep/Specflow · 172 tokens

testing

This skill should be used when the user asks about "testing", "test coverage", "unit tests", "integration tests", "test organization", "test best practices", "flaky tests", "test isolation", "TDD", "regression tests", or needs guidance on test structure, coverage requirements, and test execution.

zircote-plugins/sdlc-quality · 68 tokens

ci-rules

CI + hooks discipline — ci-test-memory-tuning (test-suite memory budget vs runner OS headroom; OOM vs worker-thrash diagnostic), github-actions-gotchas (named pitfalls: bash -e + pipefail, 21K char expression limit, SHA-pin actions, runner OOM, workerIdleMemoryLimit thrash, pullrequest vs pullrequesttarget), hooks…

Nmor/the-claude-council · 0 tokens

sw-guard

Detects project stack and existing guardrails, then interactively configures deterministic quality checks across session, commit, push, and CI/CD layers.

Obsidian-Owl/specwright · 33 tokens