ln-635-test-isolation-auditor by levnikolaevich/claude-code-skills
npx skills add https://github.com/levnikolaevich/claude-code-skills --skill ln-635-test-isolation-auditor路径说明: 文件路径(
shared/、references/、../ln-*)是相对于技能仓库根目录的。如果在当前工作目录中未找到,请定位此 SKILL.md 文件所在的目录,然后向上返回一级以找到仓库根目录。如果缺少shared/目录,请通过 WebFetch 从https://raw.githubusercontent.com/levnikolaevich/claude-code-skills/master/skills/{path}获取文件。
专门用于审计测试隔离和检测反模式的工作者。
必读: 加载 shared/references/audit_worker_core_contract.md。
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
接收包含以下内容的 contextStore:tech_stack、testFilesMetadata、codebase_root、output_dir。
必读: 加载 shared/references/two_layer_detection.md 以了解检测方法。
shared/templates/audit_worker_report_template.md 在内存中构建完整的 Markdown 报告,通过单次 Write 调用写入 {output_dir}/635-isolation.md良好: 已模拟(jest.mock、sinon、nock) 不良: 对真实外部 API 进行 HTTP 调用
检测方法:
axios.get、fetch(、http.request严重性: 高
建议: 确保外部 API 调用是受控的(模拟、存根或测试服务器)。工具选择取决于项目技术栈。例外: 集成测试预期会使用真实依赖 — 不标记
工作量: 中
良好: 内存数据库(sqlite :memory:)或已模拟 不良: 真实数据库(PostgreSQL、MySQL)
检测方法:
:memory: 的 beforeAll(async () => { await db.connect() })严重性: 中
建议: 确保数据库状态在测试运行之间是受控且隔离的。例外: 通过配置使用内存数据库的集成测试 → 跳过
工作量: 中-大
良好: 已模拟(mock-fs、vol) 不良: 真实的文件读写
检测方法:
fs.readFile、fs.writeFile严重性: 中
建议: 确保文件系统操作是隔离的(模拟、临时目录或清理)。工具选择取决于项目技术栈
工作量: 小-中
良好: 已模拟(jest.useFakeTimers、sinon.useFakeTimers) 不良: 未使用模拟的 new Date()、Date.now()
检测方法:
useFakeTimers 的 new Date()严重性: 中
建议: 确保时间相关逻辑使用受控时钟(假定时器、注入的时钟或时间提供者)。工具选择取决于项目技术栈
工作量: 小
良好: 种子随机数(Math.seedrandom、固定种子) 不良: 未设置种子的 Math.random()
检测方法:
Math.random()严重性: 低
建议: 使用种子随机数进行确定性测试
工作量: 小
良好: 已模拟(supertest for Express,无真实端口) 不良: 真实的网络请求(localhost:3000、绑定端口)
检测方法:
app.listen(3000)严重性: 中
建议: 使用 supertest(无真实端口)
工作量: 中
定义: 随机通过/失败的测试
检测方法:
setTimeout、setInterval严重性: 高
建议: 修复竞态条件,正确使用 async/await
工作量: 中-大
定义: 对当前时间的断言(expect(timestamp).toBeCloseTo(Date.now()))
检测方法:
Date.now()、new Date()严重性: 中
建议: 模拟时间
工作量: 小
定义: 以不同顺序运行时失败的测试
检测方法:
严重性: 中
建议: 隔离测试,在 beforeEach 中重置状态
工作量: 中
定义: 在测试之间修改的全局变量
检测方法:
let globalVar严重性: 中
建议: 使用 beforeEach 重置状态
工作量: 小-中
定义: 没有断言或只有琐碎断言(expect().toBeTruthy())的测试
检测方法:
toBeTruthy() → 说谎者严重性: 高
建议: 添加具体断言或删除测试
工作量: 小
示例:
createUser() 但没有断言 — 即使函数出错也总是通过createUser() 并断言 user.name 等于 'Alice',user.id 已定义定义: 超过 100 行,测试过多场景的测试
检测方法:
严重性: 中
建议: 拆分为专注的测试(每个测试一个场景)
工作量: 小-中
定义: 运行时间超过 5 秒的测试
检测方法:
严重性: 中
建议: 模拟外部依赖,使用内存数据库,并行化
工作量: 中
定义: 标记为"单元"但未模拟依赖的测试
检测方法:
严重性: 低
建议: 要么模拟依赖,要么重命名为集成测试
工作量: 小
定义: 仅测试成功案例,忽略错误
检测方法:
严重性: 中
建议: 添加负面测试(错误处理、边界情况)
工作量: 中
示例:
login(),忽略错误场景login() 抛出'无效凭据'错误定义: 验证 Express/Prisma/bcrypt(非我们的代码)的测试
检测方法:
严重性: 中
建议: 删除框架测试
工作量: 小
定义: 仅使用默认配置值的测试。必读: 加载 shared/references/risk_based_testing_guide.md → 反模式 9。
检测方法:
:8080、:3000、30000、limit: 20、offset: 0|| DEFAULT 模式严重性: 高
工作量: 小
必读: 加载 shared/references/audit_worker_core_contract.md 和 shared/references/audit_scoring.md。
严重性映射:
必读: 加载 shared/references/audit_worker_core_contract.md 和 shared/templates/audit_worker_report_template.md。
将报告写入 {output_dir}/635-isolation.md,其中包含 category: "Isolation & Anti-Patterns" 和检查项:api_isolation、db_isolation、fs_isolation、time_isolation、random_isolation、network_isolation、flaky_tests、anti_patterns、default_value_blindness。
向协调器返回摘要:
Report written: docs/project/.audit/ln-630/{YYYY-MM-DD}/635-isolation.md
Score: X.X/10 | Issues: N (C:N H:N M:N L:N)
注意: 发现项被扁平化为单个数组。使用 principle 字段前缀(Test Isolation / Determinism / Anti-Patterns)来标识问题类别。
必读: 加载 shared/references/audit_worker_core_contract.md。
principle 前缀进行区分必读: 加载 shared/references/audit_worker_core_contract.md。
{output_dir}/635-isolation.md(原子性单次 Write 调用)版本: 3.0.0 最后更新: 2025-12-23
每周安装
147
仓库
GitHub 星标
245
首次出现
2026年1月24日
安全审计
安装于
claude-code136
codex132
gemini-cli132
cursor132
opencode132
github-copilot127
Paths: File paths (
shared/,references/,../ln-*) are relative to skills repo root. If not found at CWD, locate this SKILL.md directory and go up one level for repo root. Ifshared/is missing, fetch files via WebFetch fromhttps://raw.githubusercontent.com/levnikolaevich/claude-code-skills/master/skills/{path}.
Specialized worker auditing test isolation and detecting anti-patterns.
MANDATORY READ: Load shared/references/audit_worker_core_contract.md.
Receives contextStore with: tech_stack, testFilesMetadata, codebase_root, output_dir.
MANDATORY READ: Load shared/references/two_layer_detection.md for detection methodology.
shared/templates/audit_worker_report_template.md, write to {output_dir}/635-isolation.md in single Write callGood: Mocked (jest.mock, sinon, nock) Bad: Real HTTP calls to external APIs
Detection:
axios.get, fetch(, http.request without mocksSeverity: HIGH
Recommendation: Ensure external API calls are controlled (mock, stub, or test server). Tool choice depends on project stack. Exception: Integration tests are EXPECTED to use real dependencies — do NOT flag
Effort: M
Good: In-memory DB (sqlite :memory:) or mocked Bad: Real database (PostgreSQL, MySQL)
Detection:
beforeAll(async () => { await db.connect() }) without :memory:Severity: MEDIUM
Recommendation: Ensure DB state is controlled and isolated between test runs. Exception: Integration tests with in-memory DB via config → skip
Effort: M-L
Good: Mocked (mock-fs, vol) Bad: Real file reads/writes
Detection:
fs.readFile, fs.writeFile without mocksSeverity: MEDIUM
Recommendation: Ensure file system operations are isolated (mock, temp directory, or cleanup). Tool choice depends on project stack
Effort: S-M
Good: Mocked (jest.useFakeTimers, sinon.useFakeTimers) Bad: new Date(), Date.now() without mocks
Detection:
new Date() in test files without useFakeTimersSeverity: MEDIUM
Recommendation: Ensure time-dependent logic uses controlled clock (fake timers, injected clock, or time provider). Tool choice depends on project stack
Effort: S
Good: Seeded random (Math.seedrandom, fixed seed) Bad: Math.random() without seed
Detection:
Math.random() without seed setupSeverity: LOW
Recommendation: Use seeded random for deterministic tests
Effort: S
Good: Mocked (supertest for Express, no real ports) Bad: Real network requests (localhost:3000, binding to port)
Detection:
app.listen(3000) in testsSeverity: MEDIUM
Recommendation: Use supertest (no real port)
Effort: M
What: Tests that pass/fail randomly
Detection:
setTimeout, setInterval without proper awaitsSeverity: HIGH
Recommendation: Fix race conditions, use proper async/await
Effort: M-L
What: Assertions on current time (expect(timestamp).toBeCloseTo(Date.now()))
Detection:
Date.now(), new Date() in assertionsSeverity: MEDIUM
Recommendation: Mock time
Effort: S
What: Tests that fail when run in different order
Detection:
Severity: MEDIUM
Recommendation: Isolate tests, reset state in beforeEach
Effort: M
What: Global variables modified across tests
Detection:
let globalVar at module levelSeverity: MEDIUM
Recommendation: Use beforeEach to reset state
Effort: S-M
What: Test with no assertions or trivial assertion (expect().toBeTruthy())
Detection:
toBeTruthy() → LiarSeverity: HIGH
Recommendation: Add specific assertions or delete test
Effort: S
Example:
createUser() but has NO assertions — always passes even if function breakscreateUser() and asserts user.name equals 'Alice', user.id is definedWhat: Test with >100 lines, testing too many scenarios
Detection:
Severity: MEDIUM
Recommendation: Split into focused tests (one scenario per test)
Effort: S-M
What: Test taking >5 seconds to run
Detection:
Severity: MEDIUM
Recommendation: Mock external deps, use in-memory DB, parallelize
Effort: M
What: Test labeled "Unit" but not mocking dependencies
Detection:
Severity: LOW
Recommendation: Either mock dependencies OR rename to Integration test
Effort: S
What: Only testing success cases, ignoring errors
Detection:
Severity: MEDIUM
Recommendation: Add negative tests (error handling, edge cases)
Effort: M
Example:
login() with valid credentials, ignores error scenarioslogin() with invalid credentials throws 'Invalid credentials' errorWhat: Tests validating Express/Prisma/bcrypt (NOT our code)
Detection:
Severity: MEDIUM
Recommendation: Delete framework tests
Effort: S
What: Tests with default config values only. MANDATORY READ: Load shared/references/risk_based_testing_guide.md → Anti-Pattern 9.
Detection:
:8080, :3000, 30000, limit: 20, offset: 0|| DEFAULT patterns in source code with matching test valuesSeverity: HIGH
Effort: S
MANDATORY READ: Load shared/references/audit_worker_core_contract.md and shared/references/audit_scoring.md.
Severity mapping:
MANDATORY READ: Load shared/references/audit_worker_core_contract.md and shared/templates/audit_worker_report_template.md.
Write report to {output_dir}/635-isolation.md with category: "Isolation & Anti-Patterns" and checks: api_isolation, db_isolation, fs_isolation, time_isolation, random_isolation, network_isolation, flaky_tests, anti_patterns, default_value_blindness.
Return summary to coordinator:
Report written: docs/project/.audit/ln-630/{YYYY-MM-DD}/635-isolation.md
Score: X.X/10 | Issues: N (C:N H:N M:N L:N)
Note: Findings are flattened into single array. Use principle field prefix (Test Isolation / Determinism / Anti-Patterns) to identify issue category.
MANDATORY READ: Load shared/references/audit_worker_core_contract.md.
principle prefix to distinguishMANDATORY READ: Load shared/references/audit_worker_core_contract.md.
{output_dir}/635-isolation.md (atomic single Write call)Version: 3.0.0 Last Updated: 2025-12-23
Weekly Installs
147
Repository
GitHub Stars
245
First Seen
Jan 24, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykWarn
Installed on
claude-code136
codex132
gemini-cli132
cursor132
opencode132
github-copilot127
GitHub Actions 官方文档查询助手 - 精准解答 CI/CD 工作流问题
45,200 周安装