Angular Spec Auditor

VerifiedCaution

Independently audit an Angular component spec file against project migration guidelines: strict ESLint check, spec structure, naming, and TestBed usage.

Sby Skills Guide Bot
TestingAdvanced
10/31/2026
Claude Code
#angular#unit-testing#jest#code-audit#eslint

Recommended for

Automated summary

Independently audits an Angular component spec file against the project's migration guidelines and fixes the violations it finds.

Strengths

  • Detailed checklist covering structure, naming, SPDX headers, and template behaviour coverage
  • Runs the same strict ESLint configuration used in CI and treats every reported problem as a failure
  • Prefers TestBed.inject with jest.spyOn over useValue, with clearly stated exceptions
  • Edits the spec file directly and reports every fix that was applied

Limitations

  • Relies on project-specific files (.claude/rules/angular-specs.md and .eslintrc.strict-specs.js) being present
  • Cannot auto-fix missing test coverage, and the report section appears truncated at an incomplete sentence
  • Assumes an Angular/Jest setup and a component that is either non-standalone or already standalone
When to use it

Use it to review and repair an Angular .component.spec.ts file before a migration or code review.

When not to use it

Do not use it for non-Angular tests or to audit the component implementation instead of its spec.

Security analysis

Caution
Quality score80/100

The skill is a straightforward developer-audit workflow: read a spec, run the project's ESLint check, apply style fixes, report. There is no exfiltration, no destructive command, no obfuscation, and no attempt to disable safety controls. The caution rating comes from the execution surface: it shells out to `npx eslint` with a repository-supplied config (executable JS), trusts a project rules file as its source of truth, and edits files in place without declared tool scoping.

Findings
  • •Runs `ESLINT_USE_FLAT_CONFIG=false npx eslint -c .eslintrc.strict-specs.js ...` — this executes a repo-local ESLint config file (JavaScript) and resolves npm dependencies, i.e. arbitrary code from the checked-out repository runs as a side effect of the audit.
  • •Instructs the agent to read `.claude/rules/angular-specs.md` and derive its audit criteria from it; content in that project file is an unvetted instruction channel that could redirect the agent's behavior (prompt-injection surface).
  • •Performs in-place edits to files in the working tree (spec files); the 'do not touch any component source files' guard is enforced only by model compliance, not technically.
  • •No tools are declared in `allowed-tools` even though the workflow requires shell execution and file writes — the effective permission surface is undefined and depends entirely on the host agent's defaults.
  • •Executes shell commands (`ESLINT_USE_FLAT_CONFIG=false npx eslint -c ...`) from `src/main/app/` using an interpolated spec path from `$ARGUMENTS`; `npx` may resolve/install packages, and the path is not quoted or validated, so a crafted path could alter the command (a human-supplied arg, so low exploitability).
  • •Writes to files in the repo (Step 3 auto-edits the spec). Scope is constrained to spec files with an explicit prohibition on touching component sources, which is reasonable but still an unguarded file-modification capability.
How this analysis is made

Examples

Audit a specific spec
Audit src/main/app/src/app/taken/taken-vrijgeven-dialog/taken-vrijgeven-dialog.component.spec.ts against our Angular migration guidelines and fix all violations.
Run the slash command
/audit-ng-spec-skill src/app/users/user-list.component.spec.ts
Check a newly added spec
Please check this new Angular spec for smoke tests, useValue mocks, naming issues, and missing SPDX header: src/app/orders/orders.component.spec.ts

Angular Spec Auditor

Independently audit an Angular component spec file against the project's migration guidelines.

Usage: /audit-ng-spec-skill $ARGUMENTS $ARGUMENTS = path to the spec file (relative from repo root), e.g. src/main/app/src/app/taken/taken-vrijgeven-dialog/taken-vrijgeven-dialog.component.spec.ts

If $ARGUMENTS is omitted, ask the user for the spec path before proceeding.


You did NOT write this spec. Treat it with completely fresh eyes.

Step 1 — Read context

  1. Read .claude/rules/angular-specs.md.
  2. Read the spec at {SPEC_PATH}.
  3. Derive the component path from the spec path (same directory, .component.ts instead of .component.spec.ts), read it.
  4. Derive the template path (.component.html), read it if it exists.
  5. From src/main/app/, run the check that CI applies to a touched spec, and treat every problem it reports as a FAIL: ESLINT_USE_FLAT_CONFIG=false npx eslint -c .eslintrc.strict-specs.js <spec path relative to src/main/app>. It already covers any, NO_ERRORS_SCHEMA, DOM queries outside Testing Library, and object literals cast through unknown.

Step 2 — Audit

For each item, mark PASS or FAIL with a one-line reason and the exact line(s) involved.

Rules

  • [ ] No : void return type annotations anywhere in the spec
  • [ ] No trivial smoke tests (it("should create", ...) or similar)
  • [ ] Variable naming: no single-letter or abbreviated names (el, f, res, btn). Use full descriptive names (element, fixtureRef, result, button).
  • [ ] SPDX header: new file → <current year> INFO.nl only; existing file → INFO.nl added only if completely absent from the existing line

Spec structure

  • [ ] describe(ClassName.name, ...) — class name reference, not a string literal
  • [ ] declarations: [Component] used (component is standalone: false), OR imports: [Component] if already standalone
  • [ ] Services should use TestBed.inject() + jest.spyOn() — avoid useValue: mockObject.
    • Reason: type safety. useValue accepts any object — typos, missing methods, wrong return types all silently pass. jest.spyOn is checked against the real service type, so the compiler catches mismatches.
    • Strongly preferred pattern:
      providers: [provideHttpClient(), provideRouter([]), MyService],
      // ...
      myService = TestBed.inject(MyService);
      jest.spyOn(myService, "someMethod").mockReturnValue(of(result));
      
    • useValue is acceptable when genuinely difficult to avoid (e.g. a service with a deeply complex DI tree that cannot be satisfied without significant setup). Flag it with a comment explaining why.
    • Always acceptable exceptions: Angular built-in injection tokens (MAT_DIALOG_DATA, LOCALE_ID, APP_BASE_HREF, etc.) where no real class exists to inject.
    • TranslateService → use TranslateModule.forRoot() in imports, then TestBed.inject(TranslateService) + jest.spyOn.
    • Services using ZacHttpClient → add provideHttpClient() to providers.
    • Services using Router → add provideRouter([]) to providers.
  • [ ] provideHttpClient() present if any service in the tree uses ZacHttpClient
  • [ ] provideRouter([]) present if any service in the tree uses Router

Coverage

  • [ ] Every test asserts meaningful behaviour
  • [ ] ≥90% of template behaviours covered (buttons, conditionals, outputs, form states)
  • [ ] Protected/private members accessed via bracket notation: component["member"]

Step 3 — Fix

For each FAIL: edit the spec file with the correct fix. Do NOT touch any component source files.

After all fixes are applied, re-read the spec to confirm no violations remain.

Step 4 — Report

AUDIT: PASS                         (if nothing needed fixing)
AUDIT: PASS (N issues fixed)        (if fixes were applied)

Issues fixed:
- Line X: <description of fix>
- ...

If a violation cannot be auto-fixed (e.g. missing test coverage that requires understanding domain logic), list it as a manual action required item and do not mark the audit PASS until the user addresses it.

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/angular-spec-auditor-mveraojd/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/angular-spec-auditor-mveraojd' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/angular-spec-auditor-mveraojd/download' --output '.skill-downloads/angular-spec-auditor-mveraojd/SKILL.md.part' && mv '.skill-downloads/angular-spec-auditor-mveraojd/SKILL.md.part' '.skill-downloads/angular-spec-auditor-mveraojd/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

This file does not provide a usable name/description header for this native procedure. It remains available to download and inspect; use the manual method below.

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/angular-spec-auditor-mveraojd/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills