Code & Engineering

Flaky Test Review

Reviews ONE test file for the five causes that make a test pass on one run and fail on the next, and lists only those, one line each with a fixed code, the test, why it flips and the fix - or exactly No findings. It catches a fixed sleep used to wait for background work, an expectation tied to today's date or the current time, tests that share state and only pass in one order, random values with no fixed seed, and a call to a real network address. It leaves out the safe look-alikes, such as a fake clock set before the call, a random generator built from a fixed seed, a mocked network module and fake timers moved by hand. Use to find why a test fails once in a while in CI, to review a new test file before merging, or to harden a suite that people re-run until it goes green.

Flaky Test Review is a tested SKILL.md that reviews ONE test file for the five causes that make a test pass on one run and fail on the next, and lists only those, one line each with a fixed code, the test, why it flips and the fix - or exactly No findings; an agent buys it once for $0.01 over x402.

Tested 2026-10-26No code, no hidden instructionsv1.0.0 · 5.7 KB · perpetual license

Not for

Tests that cannot fail, test speed, coverage, automatic reruns in CI and fixtures kept in other files. It reads one pasted test file and judges only what is written there, not the code under test.

Tested, honestly

Tested 2026-10-26 with a strong and a weak model.

SonnetStrong model, claude-sonnet-5-5
Right on all 3 cases, read by hand. On the pytest file it found the three-second pause and the module-level list that the second test relies on, and left out the seeded generator and the fake clock fixture. On the Jest file it found the expected month tied to today and the real rates address, and left out the seeded winner test. On the clean Jest file, with its frozen clock, mocked module, fixed seed and hand-moved timers, it answered exactly No findings.
HaikuWeak model, claude-haiku-5-5
Right on all 3 cases, read by hand. It matched the strong model on both planted files, with longer reasons that add the case of running a test alone or in random order, and kept every safe look-alike out. On the clean file it answered exactly No findings. One answer was indented by four spaces, which the check accepts.

Full test summary

Example

Our own test text, before and after the skill ran. Excerpts only.

English · claude-sonnet-5-5

Before

import random import time from app.jobs import start_export, export_done from app.reports import build_report from app.lottery import draw items = [] def test_adds_first_item(): items.append("a") assert items == ["a"] def test_adds_second_item(): items.append("b") assert items == ["a", "b"] def test_export_finishes(): job = start_export() time.sleep(3)…

After

FIXED-SLEEP — test_export_finishes, `time.sleep(3)` — on a slow runner three seconds may not be enough, and on a fast one it only wastes time — poll `export_done(job)` in a loop with a timeout instead of sleeping…

What is in the file

  • What the public source says, as read on 26 October 2026
  • The answer
  • The codes
  • Rules
  • Work in this order
  • Short example

Languages

English. Tried in: English.

License

Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing. Holder: Georgi Kalchev, aiskills402.com. Full terms.

Versions

Current version 1.0.0, updated 2026-10-26. Whoever bought an earlier version gets new ones free through the same re-download token.

  1. v1.0.0 · 2026-10-26

    First release, written in the second light-test batch of 26 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from a public testing blog post (see notes/ideas.md). Output: see the skill description.

    Test: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill rules after the runs. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand.

FAQ

Frozen time set in a setup hook: does it count as a clock problem?

No. A fake clock set before the call is the safe form, and so are fake timers that the test moves by hand. Only an expectation that reads the real date or time, with nothing earlier in the file to freeze it, gets a line.

Where do the five causes come from?

They are the skill's own list. The Google Testing Blog post names random numbers and absolute timing among the causes, but our fetch returned only the reader replies, so the text claims no more than that and gives no rate or number.

Which files went through the trial?

A pytest file with a list shared across tests and a three-second pause, a Jest file with a month in the expected text and a real rates address, and a clean Jest file with mocks and a fixed seed. Sonnet and Haiku each read all three once.

What does a stable file return?

Only the sentence No findings. A cause is reported on one line: the code, the test, the reason it flips and the repair.

Share

Read this page as Markdown: /skills/flaky-test-review.md.

More in Code & Engineering

  • CSP Header Review

    Code & Engineering

    SKILL.md · v1.0.0 · 6.0 KB

    Reviews ONE Content-Security-Policy header, with any note pasted beside it, and lists only the gaps that let injected script run or let the page be framed, one line each with a fixed code, the directive, why it hurts and the fix - or exactly No findings. It catches unsafe-eval or unsafe-inline in the script directive, a star, a data source or a bare scheme as a script source, a policy with neither object-src nor a default-src, a missing base-uri, a missing frame-ancestors, and a report-only header that the note describes as blocking. It leaves out the safe look-alikes, such as unsafe-inline in style-src only, unsafe-inline beside a nonce, a nonce with strict-dynamic, and a data source for images. Use to review a CSP before rollout, to audit the headers of a site, or to check a policy copied from a tutorial.

    $0.01once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 26 Oct 2026

  • Cookie Attributes Review

    Code & Engineering

    SKILL.md · v1.0.0 · 5.9 KB

    Reviews the Set-Cookie headers of a response, or the code that sets them, and lists only the attribute mistakes that expose a login cookie, one line each with a fixed code, the cookie, why it hurts and the fix - or exactly No findings. It catches a session cookie sent without Secure, a session cookie that script can read because HttpOnly is missing, SameSite=None without Secure, a __Host- cookie that carries a Domain or a Path other than the root, a Domain attribute wider than the host that needs the cookie, and a login cookie that lives for months. It leaves out the safe look-alikes, such as a theme or language cookie that script reads, a missing SameSite attribute, and SameSite=None together with Secure. Use to review the cookies of a login flow, to audit a framework's cookie settings, or before a security review of a web app.

    $0.01once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 26 Oct 2026

  • OAuth Redirect Flow Review

    Code & Engineering

    SKILL.md · v1.0.0 · 7.0 KB

    Reviews ONE OAuth 2.0 or OpenID Connect sign-in flow written in code for the four mistakes that let an attacker steal a login or a token, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches a state value that is never compared or not tied to the user's session, a browser or mobile client that sends no PKCE challenge, a redirect address matched by prefix or substring, and an implicit flow or an access token carried in a URL. It leaves out the safe look-alikes, such as a state kept in a cookie and compared, an exact redirect match, a server-side client with a secret, and a token sent in a header. Use to review a login integration, to audit a single-page app before launch, or to check a gateway that handles redirects.

    $0.01once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 26 Oct 2026

  • PostgreSQL Migration Lock Review

    Code & Engineering

    SKILL.md · v1.0.0 · 6.9 KB

    Reviews ONE PostgreSQL migration file for the four statements that lock or rewrite a table that is already in use, and lists only those, one line each with a fixed code, the statement, why it hurts and the fix - or exactly No findings. It catches CREATE INDEX without CONCURRENTLY on an existing table, a not-null or constraint check run in one blocking step, a column type change or volatile default that rewrites the table, and a drop or rename of a column that running code may still read. It leaves out the safe look-alikes, such as an index built concurrently, a column added with a constant default, a constraint added NOT VALID and validated separately, and the drop of a column the file says nothing reads. Use to review a migration before deploy, to plan a zero-downtime change, or to check a schema pull request.

    $0.01once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 26 Oct 2026