Skills DirectorySkills Directory
SkillsLearnSecurityCategoriesDocsCommunityBlog
Sign InSubmit Skill
Skills Directory

Security-tested agent skills for Claude, coding agents, and AI workflows.

Directory

  • Browse Skills
  • All Skills A–Z
  • Claude Skills
  • Claude Code Skills
  • Agent Skills
  • Categories
  • Submit a Skill

Learn

  • Learn Hub
  • Install Claude Skills
  • Write SKILL.md
  • Skills vs MCP
  • Directories Compared

Security

  • Security
  • Methodology
  • Secure Claude Skills
  • Security Badges

Company

  • About
  • Community
  • Blog
  • API Docs
  • Advertise

2026 Skills Directory. All rights reserved.

Back to skills

Testing Strategy

ASecurity

Design test strategies and test plans with coverage targets. Complements /draft:coverage which measures what this skill plans. Auto-loaded by /draft:implement before TDD.

40 stars
0 votes
0 copies
0 views
Added 9/22/2026
developmentgobashreactvuerailsterraformtestinggitapifrontend

Works with

cliapi

Security Analysis

A100/100

Scanned 9/22/2026

Install to Claude Code

$npx -y skills add drafthq/draft --skill testing-strategy --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Testing Strategy?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Testing Strategy
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/drafthq-testing-strategy/badge)](https://www.skillsdirectory.com/skills/drafthq-testing-strategy)

More formats (shields.io, HTML) on the badges page.

Download Zip
Files
SKILL.md
---
name: testing-strategy
description: Design test strategies and test plans with coverage targets. Complements /draft:coverage which measures what this skill plans. Auto-loaded by /draft:implement before TDD.
---

# Testing Strategy

You are designing a testing strategy and test plan for this project or track.

## Red Flags — STOP if you're

- Writing a strategy without understanding the codebase
- Setting unrealistic coverage targets (100% is rarely appropriate)
- Focusing only on unit tests and ignoring integration/E2E
- Ignoring existing test infrastructure and conventions
- Not considering the testing pyramid for this project's architecture

**A good testing strategy matches the architecture. Not every project needs the same pyramid.**

---

## Pre-Check

### 0. Capture Git Context

Before starting, capture the current git state:

```bash
git branch --show-current # Current branch name
git rev-parse --short HEAD # Current commit hash
```

Store this for the report header. The strategy is scoped to this specific branch/commit.

### 1. Verify Draft Context

```bash
ls draft/ 2>/dev/null
```

If `draft/` doesn't exist, this skill can still run standalone with reduced context.

### 2. Load Draft Context (if available)

Read and follow the base procedure in `core/shared/draft-context-loading.md`.

## Step 1: Parse Arguments

- `/draft:testing-strategy` — Project-wide strategy (default if no active track)
- `/draft:testing-strategy track <id>` — Track-scoped strategy
- `/draft:testing-strategy module <name>` — Module-scoped strategy

## Step 2: Analyze Codebase

1. **Identify component types:**
   - APIs (REST, GraphQL, gRPC)
   - Data pipelines (ETL, streaming)
   - Frontend (React, Vue, etc.)
   - Infrastructure (Terraform, K8s configs)
   - Libraries/SDKs
   - CLI tools

2. **Discover existing tests:**

   ```bash
   find . -name "*test*" -o -name "*spec*" | head -50
   ```

   Identify: test frameworks, test directories, existing coverage config, test runners.

3. **Assess current coverage:**
   Check for existing coverage reports or configuration:

   ```bash
   ls coverage/ .nyc_output/ htmlcov/ .coverage 2>/dev/null
   ```

4. **Read project context:**
   - `draft/tech-stack.md` — Test frameworks, testing conventions
   - `draft/workflow.md` — TDD preferences (strict/flexible/none)
   - `draft/.ai-context.md` — INVARIANTS section (critical paths), module boundaries, concurrency model
   - `draft/guardrails.md` — Anti-patterns that need test coverage
   - `draft/product.md` — Critical user flows that demand E2E tests

## Step 3: Design Strategy

### Testing Pyramid

Tailor to the project architecture:

```text
        ┌─────────┐
        │ E2E │ Few, critical paths only
        ├─────────┤
        │ Integr. │ Service boundaries, DB, APIs
        ├─────────┤
        │ Unit │ Business logic, utilities
        └─────────┘
```

Adjust the pyramid shape per architecture. A microservices backend may need a wider integration band. A UI-heavy app may need more E2E. A library may be almost entirely unit tests.

### Per-Component Strategy

| Component Type | Unit | Integration | E2E | Focus |
|---------------|------|-------------|-----|-------|
| API endpoints | Input validation, handlers | DB queries, auth | Critical flows | Contract testing |
| Data pipelines | Transform logic | Source/sink connections | Full pipeline | Data integrity |
| Frontend | Component rendering, hooks | API integration | User journeys | Visual regression |
| Infrastructure | Config validation | Resource provisioning | Deployment | Drift detection |
| Libraries | Public API surface | Cross-module | Consumer scenarios | Backward compat |
| CLI tools | Argument parsing, logic | File I/O, system calls | Full workflows | Exit codes, output |

### Coverage Targets

Set realistic targets based on component criticality:

- **Critical paths** (from .ai-context.md INVARIANTS): 95%+
- **Business logic**: 85-90%
- **Utilities/helpers**: 80%
- **Infrastructure/config**: 70%
- **Generated code**: Exclude from targets
- **Vendor/third-party wrappers**: 60%

### Test Quality Guidelines

Coverage alone is insufficient. Include guidance on:

- **Assertion density:** At least one meaningful assertion per test (not just "doesn't throw")
- **Boundary testing:** Edge cases, empty inputs, max values, off-by-one
- **Error paths:** Test failure modes, not just happy paths
- **Isolation:** Unit tests must not depend on external services, filesystem, or network
- **Determinism:** No time-dependent, order-dependent, or flaky tests
- **Naming:** Test names describe the scenario and expected outcome

## Step 4: Gap Analysis

Compare current state to targets:

1. Run test discovery to count existing tests per module
2. Identify modules with zero test coverage
3. Identify critical paths (from INVARIANTS) without integration tests
4. Identify user flows (from product.md) without E2E coverage
5. Identify anti-patterns (from guardrails.md) without regression tests
6. Prioritize gaps by risk: high-risk untested > low-risk untested

Present as a gap matrix:

| Module | Current Tests | Target | Gap | Risk | Priority |
|--------|--------------|--------|-----|------|----------|
| ... | ... | ... | ... | ... | ... |

## Step 5: Generate Test Plan

Priority test cases to write, ordered by impact:

1. Tests for critical invariants (from .ai-context.md)
2. Tests for anti-patterns (from guardrails.md) — regression prevention
3. Integration tests for service boundaries
4. E2E tests for critical user flows (from product.md)
5. Regression tests for known bugs
6. Property-based tests for complex business logic (if framework supports it)
7. Performance tests for latency-sensitive paths

For each priority test, specify:

- **What:** Description of the test scenario
- **Why:** Which invariant, anti-pattern, or flow it protects
- **How:** Test type (unit/integration/E2E), framework, key assertions
- **Where:** File path where the test should live

## Step 6: Save Output

**MANDATORY: Include YAML frontmatter with git metadata.** Follow `core/shared/git-report-metadata.md`.

Include the report header table immediately after frontmatter:

```markdown
| Field | Value |
|-------|-------|
| **Branch** | `{LOCAL_BRANCH}` → `{REMOTE/BRANCH}` |
| **Commit** | `{SHORT_SHA}` — {COMMIT_MESSAGE} |
| **Generated** | {ISO_TIMESTAMP} |
| **Synced To** | `{FULL_SHA}` |
```

Save to:

- Project-wide: `draft/testing-strategy.md`
- Track-scoped: `draft/tracks/<id>/testing-strategy.md`

## Cross-Skill Dispatch

- **Auto-loaded by:** `/draft:implement` (before TDD cycle)
- **Suggested by:** `/draft:decompose` (after module definition), `/draft:init` (after setup)
- **Feeds into:** `/draft:coverage` (measurement against targets set here)
- **References:** `/draft:bughunt` findings as regression test candidates

## Error Handling

**If no test infrastructure found:** Recommend test framework based on tech-stack.md, include setup steps needed before tests can be written
**If no draft context:** Generate generic strategy, suggest running `/draft:init` for better results
**If conflicting test patterns found:** Document both patterns, recommend consolidation as a tech-debt item

Attribution

drafthqdrafthq
View sourceMore from drafthq →
SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Related Skills

Browser Extension Developer

Use this skill when developing or maintaining browser extension code in the `browser/` directory, including Chrome/Firefox/Edge compatibility, content scripts, background scripts, or i18n updates.

284072 votes

Seo Optimizer

SEO optimization with keyword analysis, readability assessment, technical validation, content quality. Use for search rankings, blog posts, content audits, or encountering keyword density, readability scores, meta tags, schema markup errors.

2192 votes

Google Official Seo Guide

Official Google SEO guide covering search optimization, best practices, Search Console, crawling, indexing, and improving website search visibility based on official Google documentation

1862 votes

Tanstack Start

Build a full-stack TanStack Start app on Cloudflare Workers from scratch — SSR, file-based routing, server functions, D1+Drizzle, better-auth, Tailwind v4+shadcn/ui. Use whenever the user mentions TanStack Start, asks to scaffold a full-stack Cloudflare app with SSR, wants an SSR dashboard, or asks for a React 19 + Cloudflare Workers app with file-based routing and server functions — even if they don't name TanStack Start specifically. No template repo — Claude generates every file fresh per ...

9881 votes

Pentest

PTES-aligned adversarial security audit for backend, frontend, and mobile applications. Produces a CVSS-scored Hacker Report with verified PoCs and phased remediation.

5491 votes
View all in development →