Skip to content
skillsafebeta
← Report library
Purpose / Writing

Javascript Testing Patterns Skill Security Audit

What the author says it does (original text)

Implement comprehensive testing strategies using Jest, Vitest, and Testing Library for unit tests, integration tests, and end-to-end testing with mocking, fixtures, and test-driven development. Use when writing JavaScript/TypeScript tests, setting up test infrastructure, or implementing TDD/BDD workflows.

Independent security check

Do not install or run it yet

Files checked
2
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
High risk

Integration tests truncate and drop the users table without proving the database is disposable

Source references: 6
What we found

The guide calls for truncating the table before every test and dropping it afterward. One API example reuses the application's database connection without checking the database name, environment, or production status. A second example names test_db explicitly but performs the same destructive queries.

Why this matters

If application configuration, environment variables, or local credentials point to a shared, development, or production database, running the tests could permanently erase every user record or the entire users table.

The source supports this risk, though these are testing examples to be adopted, not operations already executed by the Skill. The guide requires truncation before tests and teardown afterward; the API example imports the application's pool and then drops/truncates users without checking the environment or database name. If misconfigured to a shared or production database, it could permanently remove the table or its data. Users can ask for a hard test-database guard and verify the connection target and account permissions before running it.

SKILL.md:490In the instructionsOpen original file
Integration tests verify real database operations and HTTP endpoints using `supertest` and a test database instance. Always truncate tables in `beforeEach` and tear down in `afterAll`.For full API integration test examples (supertest + PostgreSQL) and database repository integration tests, see [references/advanced-testing-patterns.md](references/advanced-testing-patterns.md).
Show 5 other places
references/advanced-testing-patterns.md:11In the instructionsOpen original file
// tests/integration/user.api.test.tsimport request from "supertest";import { app } from "../../src/app";import { pool } from "../../src/config/database";describe("User API Integration Tests", () => {  beforeAll(async () => {    // Setup test database    await pool.query("CREATE TABLE IF NOT EXISTS users (...)");  });
references/advanced-testing-patterns.md:21In the instructionsOpen original file
  afterAll(async () => {    // Cleanup    await pool.query("DROP TABLE IF EXISTS users");    await pool.end();  });  beforeEach(async () => {    // Clear data before each test    await pool.query("TRUNCATE TABLE users CASCADE");  });
references/advanced-testing-patterns.md:155In the instructionsOpen original file
  beforeAll(async () => {    pool = new Pool({      host: "localhost",      port: 5432,      database: "test_db",      user: "test_user",      password: "test_password",    });
references/advanced-testing-patterns.md:13In the instructionsOpen original file
import { app } from "../../src/app";import { pool } from "../../src/config/database";
references/advanced-testing-patterns.md:27In the instructionsOpen original file
  beforeEach(async () => {    // Clear data before each test    await pool.query("TRUNCATE TABLE users CASCADE");  });
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The global fetch mock is not restored and can contaminate other tests in the same process

Source references: 3
What we found

The example directly overwrites global.fetch, while setup only calls vi.clearAllMocks. That clears call history but does not restore the original fetch implementation.

Why this matters

Later tests in the same process that should exercise real or different network behavior may keep using the empty mock, causing misleading passes, unexpected return values, or missed defects.

This risk is supported, but only if the example is adopted in a process shared with other tests. It directly replaces global.fetch, while beforeEach only calls vi.clearAllMocks and does not restore the original global function. Later tests expecting real fetch behavior may therefore keep using the mock, causing false results or failures. Users can ask for an example using a spy restored in afterEach, or restrict the global mock to an isolated test file/process.

SKILL.md:239In the instructionsOpen original file
// Mock fetch globallyglobal.fetch = vi.fn();describe("ApiService", () => {  let service: ApiService;  beforeEach(() => {    service = new ApiService();    vi.clearAllMocks();  });
Show 2 other places
SKILL.md:235In the instructionsOpen original file
// services/api.service.test.tsimport { describe, it, expect, vi, beforeEach } from "vitest";import { ApiService } from "./api.service";// Mock fetch globallyglobal.fetch = vi.fn();
SKILL.md:245In the instructionsOpen original file
  beforeEach(() => {    service = new ApiService();    vi.clearAllMocks();  });
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This is a testing-pattern reference guide composed of configuration and example code; the supplied source contains no installer, automatic execution entry point, or instruction to elevate privileges.

View source
SKILL.md:2In the instructionsOpen original file
---name: javascript-testing-patternsdescription: Implement comprehensive testing strategies using Jest, Vitest, and Testing Library for unit tests, integration tests, and end-to-end testing with mocking, fixtures, and test-driven development. Use when writing JavaScript/TypeScript tests, setting up test infrastructure, or implementing TDD/BDD workflows.---
SKILL.md:6In the instructionsOpen original file
# JavaScript Testing PatternsComprehensive guide for implementing robust testing strategies in JavaScript/TypeScript applications using modern testing frameworks and best practices.

The asynchronous API unit tests replace global fetch with a Vitest mock, so the example tests do not actually contact api.example.com.

View source
SKILL.md:239In the instructionsOpen original file
// Mock fetch globallyglobal.fetch = vi.fn();
SKILL.md:254In the instructionsOpen original file
      (fetch as any).mockResolvedValueOnce({        ok: true,        json: async () => mockUser,      });

The email implementation reads SMTP credentials from environment variables and sends mail, but its accompanying test explicitly mocks nodemailer and sendMail; real mail would occur only if the service implementation were used outside that mocked test environment.

View source
SKILL.md:308In the instructionsOpen original file
export class EmailService {  private transporter = nodemailer.createTransport({    host: process.env.SMTP_HOST,    port: 587,    auth: {      user: process.env.SMTP_USER,      pass: process.env.SMTP_PASS,    },  });  async sendEmail(to: string, subject: string, html: string) {    await this.transporter.sendMail({      from: process.env.EMAIL_FROM,      to,      subject,      html,    });  }
SKILL.md:331In the instructionsOpen original file
vi.mock("nodemailer", () => ({  default: {    createTransport: vi.fn(() => ({      sendMail: vi.fn().mockResolvedValue({ messageId: "123" }),    })),  },}));
Start here · InstructionsSKILL.md
javascript-testing-patterns
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/advanced-testing-patterns.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/advanced-testing-patterns.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:218In the instructionsOpen original file
  async fetchUser(id: string): Promise<User> {    const response = await fetch(`https://api.example.com/users/${id}`);    if (!response.ok) {
SKILL.md:226In the instructionsOpen original file
  async createUser(user: CreateUserDTO): Promise<User> {    const response = await fetch("https://api.example.com/users", {      method: "POST",
SKILL.md:262In the instructionsOpen original file
      expect(user).toEqual(mockUser);      expect(fetch).toHaveBeenCalledWith("https://api.example.com/users/1");    });
Read keys or account settings
SKILL.md:309In the instructionsOpen original file
  private transporter = nodemailer.createTransport({    host: process.env.SMTP_HOST,    port: 587,
SKILL.md:312In the instructionsOpen original file
    auth: {      user: process.env.SMTP_USER,      pass: process.env.SMTP_PASS,
SKILL.md:313In the instructionsOpen original file
      user: process.env.SMTP_USER,      pass: process.env.SMTP_PASS,    },
Lines read
1,052
File checksum (to compare versions)
fb0a025f6be283ab36f8ea499d755ee2221901936c25dfd784bc67294c149518