Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/w2ur/claude-code-setup/testing-conventionsnpx skills add w2ur/claude-code-setup --skill testing-conventionsgit clone --depth 1 https://github.com/w2ur/claude-code-setupWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00081 | $0.00746 |
| Opus 5 | $0.00041 | $0.00373 |
| Sonnet 5 | $0.00016 | $0.00149 |
| Haiku 4.5 | $0.00008 | $0.00075 |
Grade A, and why
testing-conventions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Testing conventions
The rules live in ~/.claude/CLAUDE.md. This skill holds the formats and settings.
Unit and regression
-
Unit tests for all logic.
-
A regression test alongside every bug fix, carrying the commit that fixed it:
// Regression: <commit-hash> — <bug description>The hash makes the test self-documenting: a future reader can pull the fix and the reasoning without archaeology in the test file itself.
Property tests for pure transforms
- TypeScript →
fast-check - Python →
hypothesis - File naming:
foo.property.test.tsalongside the unit tests.
Financial-math arbitraries — settings tuned by measurement
| setting | value | why |
|---|---|---|
| float arbitraries | noNaN, noDefaultInfinity |
otherwise every property fails on degenerate inputs rather than on real ones |
| runs | ≥ 1000 | the default run count does not reach the interesting tail |
| tolerance | 1e-6 | not 1e-10 — measured too tight at scale. Accumulated float error over a long series exceeds 1e-10 legitimately, so the tighter tolerance reports false failures. |
The 1e-10 value looks more rigorous and is the obvious thing to reach for. It was tried and it was wrong. Use 1e-6.
A test can pin a defect — read its intent before "fixing" it
When a check disagrees with what you expect, read the test's intent before assuming the code is wrong. Twice in a single day the test was the one asserting the truth:
test_check_ignores_generic_data_driftasserted "data is synced but not guarded" — the surprising behaviour was the deliberate one, named in the test.- A Python and a TypeScript implementation each pinned the other's answer as correct, so "fixing" either one to match intuition would have broken the pair.
A test whose name states an intent is evidence about the design, not just about the code path.
What a green suite does not cover
Two measured blind spots in this portfolio:
- UI components are not unit-tested by convention. In
my-fitness-app, 1,155 tests passed against a tree that would not build — a deleted module was still imported by two components. Only the build gate caught it. - A route-handler test never runs the middleware. A gated API route can ship 100% broken with a fully green suite. Test the middleware path separately.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 72 lines · 81 tokens per session scan A 77629ef06b48
testing-conventions is a skill published in the GitHub repository w2ur/claude-code-setup (2 stars, last pushed 9d ago), licensed MIT. It adds 81 tokens to every session and 746 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
clinpgx-database
Access ClinPGx pharmacogenomics data (successor to PharmGKB). Query gene-drug interactions, CPIC guidelines, allele functions, for precision medicine and genotype-guided dosing decisions.
embedding-strategies
Select and optimize embedding models for semantic search and RAG applications. Use when choosing embedding models, implementing chunking strategies, or optimizing embedding quality for specific domains.
docx-comment-reply
Reply to comments (批注) in Word .docx/.doc files: extract comment context, draft replies, write threaded replies back, and validate OOXML.
flow-next-resolve-pr
Resolve PR review feedback. Fetches unresolved threads, triages, fixes, replies and resolves via GraphQL. Use when asked to address review comments.
flow-next-tracker-sync
Project a flow-next spec to a tracker issue (Linear, GitHub, GitLab, Jira) and reconcile two-way. Use when asked to sync to a tracker. NOT plan-sync.
flow-next-prime
Assess codebase agent and production readiness. Classifies the project, verifies commands run, leads with a verdict and ranked next actions.