From test-copilot
Comprehensive test engineering knowledge base for creating, reviewing, and improving test strategies and test cases. Use when writing test cases, designing test strategies, performing security testing, checking OWASP Top 10 vulnerabilities, generating REST API contract tests, writing BDD-Gherkin scenarios for web applications, testing GraphQL queries and mutations, creating mobile app test matrices, testing microservices with circuit breakers and event-driven patterns, setting performance benchmarks, prioritizing tests by risk level, detecting project type for test framework selection, reviewing existing test coverage, generating executable test code (Playwright, Jest, Vitest, pytest, JUnit, etc.) from an approved strategy, or scaffolding CI pipelines for tests. Invoked by test-engineer-agent (strategy generation) and test-codegen-agent (code generation).
How this skill is triggered — by the user, by Claude, or both
Slash command
/test-copilot:test-engineer-skillThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
- Every test case MUST be immediately implementable — no vague descriptions, every assertion must be specific
sleep() or static waits — always use explicit waits, polling, or event-driven approachesFollow these steps in order when invoked:
Scan the codebase using Glob and Grep to identify the project type:
Glob patterns to check:
- package.json, tsconfig.json → Node.js project
- requirements.txt, setup.py, pyproject.toml → Python project
- pom.xml, build.gradle → Java project
- *.xcodeproj, *.xcworkspace, AndroidManifest.xml → Mobile project
- Dockerfile, docker-compose.yml, k8s/ → Microservices/containers
Grep patterns to detect framework:
- "express|fastify|koa|hono" → REST API
- "graphql|apollo|type-graphql" → GraphQL
- "next|nuxt|remix|vite|react|vue|angular" → Web Application
- "react-native|flutter|swiftui|jetpack" → Mobile Application
- "kafka|rabbitmq|grpc|nats" → Microservices/Event-driven
You may detect multiple types — apply all relevant sections below.
First, check if a test framework is already configured:
Grep in config files for: jest|vitest|mocha|cypress|playwright|pytest|unittest|junit|testify|detox
Read: package.json → scripts.test, devDependencies
Read: pyproject.toml → [tool.pytest], [project.optional-dependencies]
Read: pom.xml → dependencies (junit, testng)
If a test framework is found → USE IT. Do not recommend a different one.
If no test framework is found, map the detected tech stack:
| Tech Stack | Test Framework | Assertion Library |
|---|---|---|
| Node.js/TypeScript | Jest / Vitest | built-in |
| Python | Pytest | built-in |
| Java | JUnit 5 | AssertJ |
| Go | testing (stdlib) | testify |
| React/Vue frontend | Cypress / Playwright | built-in |
| React Native | Detox / Maestro | built-in |
| Flutter | integration_test | built-in |
| .NET | xUnit / NUnit | FluentAssertions |
Before generating new tests, check what already exists:
Glob: **/*.test.*, **/*.spec.*, **/test_*, **/*_test.*, **/__tests__/**
Read every test file found. For each file, record:
You will EXTEND existing tests, never duplicate them.
Read the conditional sections below that match the detected project type. Skip sections that don't apply.
Use the Few-Shot Output Templates at the bottom to format your response.
Use when: Express, Fastify, Koa, Hono, Django REST, Flask, Spring Boot, ASP.NET detected
Test Categories (implement ALL):
Test case format:
| Endpoint | Method | Headers | Request Body | Expected Response | Status Code |
|----------|--------|---------|-------------|-------------------|-------------|
| /api/users | POST | Authorization: Bearer {token} | {"name":"test","email":"[email protected]"} | {"id":1,"name":"test","email":"[email protected]"} | 201 |
| /api/users | POST | (no auth) | {"name":"test","email":"[email protected]"} | {"error":"Unauthorized"} | 401 |
| /api/users | POST | Authorization: Bearer {token} | {"name":""} | {"error":"name is required"} | 400 |
Pagination Tests — Verify limit/offset or cursor-based pagination
Filtering & Sorting Tests — Every filter parameter, every sort direction
Error Handling Tests
Security Header Tests
Verify response headers on ALL endpoints:
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY
- Strict-Transport-Security: max-age=...
- Content-Security-Policy: (appropriate policy)
- X-Request-ID: (present and unique)
Use when: Apollo, TypeGraphQL, GraphQL.js, Hasura, Strawberry detected
Test Categories (implement ALL):
Query Depth & Complexity Tests
Resolver Tests
Mutation Side Effect Tests
Schema Integrity Tests
Use when: React, Vue, Angular, Next.js, Nuxt, Remix, Svelte detected
Test Categories (implement ALL):
Format: Use BDD-Gherkin (Given-When-Then)
Example:
Feature: User Login
Scenario: Successful login with valid credentials
Given the user is on the login page
And the user has a valid account with email "[email protected]"
When the user enters "[email protected]" in the email field
And the user enters "correctpassword" in the password field
And the user clicks the "Sign In" button
Then the user should be redirected to the dashboard
And the navigation bar should display the user's name
Scenario: Login fails with incorrect password
Given the user is on the login page
When the user enters "[email protected]" in the email field
And the user enters "wrongpassword" in the password field
And the user clicks the "Sign In" button
Then the page should display "Invalid email or password"
And the password field should be cleared
And the user should remain on the login page
Must-test areas:
<img> has meaningful alt text<label> elementsUse when: React Native, Flutter, Swift, Kotlin, Android detected
Test Categories (implement ALL):
Test across:
| Condition | Latency | Bandwidth | Packet Loss |
|-----------|---------|-----------|-------------|
| Offline | ∞ | 0 | 100% |
| Poor 2G | 2000ms | 50 Kbps | 5% |
| Good 3G | 500ms | 750 Kbps | 1% |
| WiFi | 50ms | 10 Mbps | 0% |
For each condition verify:
- App shows appropriate offline/loading indicator
- Failed requests are queued and retried when connection restored
- No data corruption on interrupted transfers
App Lifecycle Tests
Device Matrix Priority (test top 80% of user base)
Priority order:
1. Latest 2 OS versions (iOS 17-18, Android 14-15)
2. Most common screen sizes (iPhone 15, Samsung Galaxy S24, etc.)
3. Minimum supported OS version (ensure app doesn't crash on old devices)
Use when: Docker, Kubernetes, Kafka, RabbitMQ, gRPC, NATS, service mesh detected
Test Categories (implement ALL):
Contract Testing (Consumer-Driven)
Failure Mode Tests
Event/Message Tests
Distributed Tracing
Apply to ALL project types. Test every item below:
' OR 1=1 --, "; DROP TABLE users; -- → expect 400 or sanitized input{"$gt": ""}, {"$where": "sleep(5000)"} → expect rejection; rm -rf /, $(cat /etc/passwd) → expect sanitized or rejected*)(objectClass=*, *)(uid=*))(|(uid=* → expect rejectionexp claim → expect 401jti → expect 401expires_at → expect 401Retry-After header is present on 429 responseDefine targets before testing:
Template:
| Metric | Target | Measurement |
|--------|--------|-------------|
| p50 Response Time | ≤ 200ms | API endpoints |
| p95 Response Time | ≤ 500ms | API endpoints |
| p99 Response Time | ≤ 1000ms | API endpoints |
| Throughput | ≥ {N} req/s | Sustained load |
| Error Rate | ≤ 0.1% | Under normal load |
| CPU Utilization | ≤ 70% | Under peak load |
| Memory Utilization | ≤ 80% | Steady state |
| DB Connection Pool | ≤ 80% used | Under peak load |
Stress test: Double expected peak load → verify graceful degradation, not crash
Use this to decide test execution order:
| Priority | Areas | Minimum Coverage Target |
|---|---|---|
| Critical | Authentication, payment, data deletion, security controls, PII handling | 100% — every path tested |
| High | User data modification, bulk operations, external integrations, data persistence | ≥ 90% |
| Medium | Read operations, search/filter, reporting, non-sensitive data retrieval | ≥ 80% |
| Low | Static content, cosmetic UI, optional features, admin-only settings | ≥ 60% |
# Test Strategy: {Project Name}
## Detected Project Type
- Primary: REST API (Express.js)
- Secondary: Web Application (React)
- Test Framework: Jest + Supertest
## Test Plan Summary
- Total test suites: 12
- Total test cases: 87
- Estimated execution time: ~4 minutes (parallel)
## Test Cases
### Suite: Auth API (`/api/auth`)
| # | Test Case | Method | Endpoint | Input | Expected | Status |
|---|-----------|--------|----------|-------|----------|--------|
| 1 | Login with valid credentials | POST | /api/auth/login | {email, password} | 200 + JWT token | Critical |
| 2 | Login with wrong password | POST | /api/auth/login | {email, "wrong"} | 401 + error message | Critical |
| 3 | Login with malformed email | POST | /api/auth/login | {email: "notemail"} | 400 + validation error | High |
| ... | ... | ... | ... | ... | ... | ... |
### Security Tests
- [ ] SQL injection on login email field
- [ ] Rate limit: >5 failed logins in 15 min → 429
- [ ] JWT expiry validation
### Recommended Next Steps
1. Add these test files: `tests/auth.test.ts`, `tests/users.test.ts`
2. Run `npm test -- --coverage` to verify coverage ≥ 80%
3. Add CI pipeline step: `npm run test:integration`
# Test Strategy: {Project Name}
## Detected Project Type
- Primary: Web Application (Next.js + React)
- Test Framework: Playwright + Jest
## BDD Test Scenarios
### Feature: User Registration
Scenario: Register with valid information
Given the user is on "/register"
When the user fills in "email" with "[email protected]"
And the user fills in "password" with "Str0ng!Pass"
And the user fills in "confirmPassword" with "Str0ng!Pass"
And the user clicks "Create Account"
Then the user should be redirected to "/verify-email"
And a verification email should be sent to "[email protected]"
Scenario: Register with existing email
Given the user is on "/register"
And a user with email "[email protected]" already exists
When the user fills in "email" with "[email protected]"
And the user fills in "password" with "Str0ng!Pass"
And the user clicks "Create Account"
Then the page should display "An account with this email already exists"
And no new account should be created
### Accessibility Tests
- [ ] Tab order follows logical reading sequence on registration form
- [ ] All form inputs have visible labels
- [ ] Error messages are announced by screen reader (aria-live)
- [ ] Color contrast of error text ≥ 4.5:1
### Cross-Browser Matrix
| Browser | Version | Status |
|---------|---------|--------|
| Chrome | 120+ | Required |
| Firefox | 121+ | Required |
| Safari | 17+ | Required |
| Edge | 120+ | Required |
### Recommended Next Steps
1. Create Playwright tests in `e2e/registration.spec.ts`
2. Run `npx playwright test --reporter=html`
3. Add accessibility audit: `npx axe-core --include=register`
Used by test-codegen-agent only — after a human approves the strategy. This converts approved test cases into runnable code. It does NOT apply to the strategy phase.
Generated Playwright code MUST follow these rules:
page.getByRole(), page.getByLabel(), page.getByText(), or page.getByTestId(). Never brittle CSS/XPath tied to layout.page.waitForTimeout(). Rely on Playwright auto-waiting and web-first assertions like await expect(locator).toBeVisible().await test.step('<step text>', async () => { ... }) so the run maps back to the approved scenarios reviewed in the strategy phase.test.beforeEach() (or fixtures). No shared mutable state, no ordering dependency — every test must run alone.// tests/e2e/ai-generated/login.spec.ts (mirrors an approved BDD scenario)
import { test, expect } from '@playwright/test';
test.describe('User Login', () => {
test.beforeEach(async ({ page }) => {
await page.goto('/login'); // base URL from playwright.config, not hard-coded
});
test('login fails with incorrect password', async ({ page }) => {
await test.step('enter credentials', async () => {
await page.getByLabel('Email').fill('[email protected]');
await page.getByLabel('Password').fill('wrongpassword');
await page.getByRole('button', { name: 'Sign In' }).click();
});
await test.step('see error and stay on page', async () => {
await expect(page.getByText('Invalid email or password')).toBeVisible();
await expect(page).toHaveURL(/\/login/);
});
});
});
tests/e2e/ai-generated/, or <existing-test-dir>/ai-generated/) so human-written vs. AI-drafted code stays distinguishable.npx playwright install --with-deps, run npx playwright test, and publish the Playwright HTML report as a CI artifact.playwright.config.ts, env vars), not literals.secrets.*); document which secrets are required.beforeEach/fixtures and must be self-cleaning or isolated per run — never depend on data left behind by another test.Provides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.
npx claudepluginhub piyabordee/test-copilot --plugin test-copilot