test-audit

An agent skill by garrytan, from garrytan/gstack. Tags: cleanup, code-quality, review, testing.

What it does

Find low-value or duplicate tests and the test-only code they keep alive. (gstack)

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill test-audit

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/test-audit ~/.claude/skills/test-audit

Safety box score

Grade C, moderate risk: 44 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a repo-wide test audit that shells out to local helper scripts, scans tests, writes reports, and can delete test code after an approval gate. The main risks are home-directory writes outside the repo, instruction-pressure from helper-script output, and the fact that the real behavior depends on unread `~/.claude/skills/gstack/bin/*` scripts.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It runs Bash and several local helpers like `~/.claude/skills/gstack/bin/gstack-skill-start`, `gstack-context-recovery`, and `gstack-skill-end`, plus `git grep` and `git log`, so it has real command-execution surface.
Network access	0 (none)	No explicit network fetches, uploads, or remote API calls are shown; the telemetry and report paths are local filesystem writes in the evidence provided.
Filesystem reach	2 (moderate)	It writes outside the repo to `$GSTACK_STATE_ROOT/projects/$SLUG/...`, `$GSTACK_STATE_ROOT/analytics/`, and `~/.claude/skills/gstack/`, and Step 6 can edit or delete repo files.
Secrets & credentials	0 (none)	The skill does not request credential stores, tokens, key files, or browser sessions; the session-cookie text is just an example in prose, not an action.
Privilege & persistence	1 (low)	It does not ask for sudo or services, but it does create persistent home-directory state and telemetry files, so it reaches beyond a normal read-only repo workflow.
Instruction hijack surface	2 (moderate)	It tells the agent to treat the skill file as executable instructions and to honor `GSTACK_INSTRUCTION_BEGIN` blocks from tool output, with auto-choice behavior in spawned/unattended sessions.
Irreversible actions	2 (moderate)	The skill can retire tests and delete test-only exports, globals, and wrappers in an approved batch, which is bounded by user approval but still changes repo contents.
Transparency	2 (moderate)	Important behavior depends on unread helper scripts in `~/.claude/skills/gstack/bin/`, so the actual side effects cannot be fully audited from `SKILL.md` alone.

Before installing

Inspect `~/.claude/skills/gstack/bin/gstack-skill-start` and `gstack-skill-end` before trusting the workflow.
Check where `$GSTACK_STATE_ROOT` points and whether you want reports/telemetry written there.
Run it once on a throwaway branch and read the generated report before approving any batch edits.

Rated 2026-10-16 by an automated review of 1 file from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: test-audit/SKILL.md
Branch: main
Updated: 2026-10-05

deslop — Remove AI-generated code slop and clean up code style
principle-test-behavior-not-implementation — Apply when you write, change, or keep a test. Call the code the way its users do and assert the result they observe against a literal expected value.
migrate-to-shoehorn — Migrate test files from `as` type assertions to @total-typescript/shoehorn.
audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
check-compiler-errors — Run compile and type-check commands and report failures
code-improver — Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names.