Skip to content
skillsafebeta
← Report library
Purpose / Writing

Python Testing Patterns Skill Security Audit

What the author says it does (original text)

Implement comprehensive testing strategies with pytest, fixtures, mocking, and test-driven development. Use when writing Python tests, setting up test suites, or implementing testing best practices.

Independent security check

Security risks found

Files checked
3
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Examples install unlocked Python dependencies and use mutable CI Action versions

Source references: 3
What we found

The quick start installs pytest-cov without a version, while the CI example installs the project's dev extras and runs third-party GitHub Actions through v3/v4 tags. Those references can resolve to different code over time, and both dependency installation and Actions can execute code.

Why this matters

If copied, the package versions selected at that time, the project's build backend, or subsequently changed Action code would execute with the user's local or CI-runner permissions.

These are examples for a user to adopt; merely reading the Skill does not run them. If copied, CI installs the currently resolved project dev dependencies, pytest, and pytest-cov, and executes GitHub Actions referenced by mutable major-version tags. Both dependency installation and Actions can execute code on the CI runner. The user can ask for lockfiles or hashes and for Actions pinned to reviewed commit SHAs.

SKILL.md:261In the instructionsOpen original file
```bash# Install coveragepip install pytest-cov# Run tests with coverage
Show 2 other places
references/advanced-patterns.md:344In the instructionsOpen original file
    steps:      - uses: actions/checkout@v3      - name: Set up Python        uses: actions/setup-python@v4        with:          python-version: ${{ matrix.python-version }}      - name: Install dependencies        run: |          pip install -e ".[dev]"          pip install pytest pytest-cov
references/advanced-patterns.md:361In the instructionsOpen original file
      - name: Upload coverage        uses: codecov/codecov-action@v3        with:          file: ./coverage.xml```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

The CI example uploads the coverage report to Codecov

Source references: 1
What we found

The workflow generates coverage.xml and then gives that file to an external service through the Codecov Action. Coverage XML commonly contains project file paths and per-file or per-line coverage metadata.

Why this matters

Once adopted, code-structure and test-coverage information leaves the GitHub runner. For a private or sensitive repository, this may disclose internal engineering metadata to an unapproved third party.

The example explicitly generates coverage.xml and then passes it to the Codecov Action. Upload occurs only if a user adopts this workflow and CI is triggered. The source does not show the report's actual contents, Codecov configuration, or repository visibility, so the particular paths or coverage data exposed cannot be confirmed; transmission of the report to a third party is nevertheless supported. The user can ask what fields are sent, what credential permissions apply, and how long data is retained, or disable this step.

references/advanced-patterns.md:357In the instructionsOpen original file
      - name: Run tests        run: |          pytest --cov=myapp --cov-report=xml      - name: Upload coverage        uses: codecov/codecov-action@v3        with:          file: ./coverage.xml```
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 2
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

This is an installation command in a coverage-reporting example, not an automatic Skill action. Only if the user copies and runs it will pip resolve the then-current pytest-cov version from the configured package index; because no version is pinned, the retrieved code may change over time. The user can ask for a pinned version or hashes and review it in an isolated environment first.

SKILL.md:263In the instructionsOpen original file
# Install coveragepip install pytest-cov
Show 1 other places
SKILL.md:261In the instructionsOpen original file
```bash# Install coveragepip install pytest-cov# Run tests with coverage
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

This Skill is a collection of Python-testing guidance and examples covering pytest, fixtures, mocking, TDD, databases, and CI/CD. The supplied content has no automatic execution entry point.

View source
SKILL.md:2In the instructionsOpen original file
---name: python-testing-patternsdescription: Implement comprehensive testing strategies with pytest, fixtures, mocking, and test-driven development. Use when writing Python tests, setting up test suites, or implementing testing best practices.---
SKILL.md:12In the instructionsOpen original file
- Writing unit tests for Python code- Setting up test suites and test infrastructure- Implementing test-driven development (TDD)- Creating integration tests for APIs and services- Mocking external dependencies and services- Testing async code and concurrent operations- Setting up continuous testing in CI/CD- Implementing property-based testing- Testing database operations- Debugging failing tests

The main document directs the agent to two bundled reference files for detailed and advanced patterns; both referenced documents are present in the supplied source.

View source
SKILL.md:69In the instructionsOpen original file
## Detailed patterns and worked examplesDetailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.
SKILL.md:278In the instructionsOpen original file
For advanced patterns (async testing, monkeypatching, property-based testing, database testing, CI/CD integration, and configuration), see [references/advanced-patterns.md](references/advanced-patterns.md)

File- and network-related code appears as worked examples: file writes use pytest's tmp_path, while API tests replace requests calls with patches. These snippets do not show automatic file or network access upon Skill installation.

View source
references/advanced-patterns.md:116In the instructionsOpen original file
def test_file_operations(tmp_path):    """Test file operations with temporary directory."""    # tmp_path is a pathlib.Path object    test_file = tmp_path / "test_data.txt"    # Save data    save_data(test_file, "Hello, World!")
references/details.md:217In the instructionsOpen original file
def test_get_user_success():    """Test successful API call with mock."""    client = APIClient("https://api.example.com")    mock_response = Mock()    mock_response.json.return_value = {"id": 1, "name": "John Doe"}    mock_response.raise_for_status.return_value = None    with patch("requests.get", return_value=mock_response) as mock_get:        user = client.get_user(1)
Start here · InstructionsSKILL.md
python-testing-patterns
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 3
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records3 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/advanced-patterns.mdFull text included
  • references/details.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/advanced-patterns.mdSupporting file
  • references/details.mdSupporting file

Operations mentioned in code and instructions

Read files
SKILL.md:71In the instructionsOpen original file
Detailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.
references/advanced-patterns.md:113In the instructionsOpen original file
    """Load data from file."""    return filepath.read_text()
Connect to websites
SKILL.md:148In the instructionsOpen original file
    service = ServiceWithRetry(client, max_retries=3)    result = service.fetch()
SKILL.md:161In the instructionsOpen original file
    with pytest.raises(ConnectionError):        service.fetch()
SKILL.md:173In the instructionsOpen original file
    with pytest.raises(ValueError):        service.fetch()
Run commands
SKILL.md:261In the instructionsOpen original file
```bash# Install coverage
Install extra software packages
SKILL.md:263In the instructionsOpen original file
# Install coveragepip install pytest-cov
references/advanced-patterns.md:354In the instructionsOpen original file
        run: |          pip install -e ".[dev]"          pip install pytest pytest-cov
references/advanced-patterns.md:355In the instructionsOpen original file
          pip install -e ".[dev]"          pip install pytest pytest-cov
Read keys or account settings
references/advanced-patterns.md:60In the instructionsOpen original file
    """Get database URL from environment."""    return os.environ.get("DATABASE_URL", "sqlite:///:memory:")
references/advanced-patterns.md:86In the instructionsOpen original file
    def __init__(self):        self.api_key = "production-key"
references/advanced-patterns.md:88In the instructionsOpen original file
    def get_api_key(self):        return self.api_key
Change files
references/advanced-patterns.md:108In the instructionsOpen original file
    """Save data to file."""    filepath.write_text(data)
Lines read
1,041
File checksum (to compare versions)
ab4fed5ed147b9fd9a9b52baf09dd0173f5b6d14b7ed8daf432735f5d774b27c