Skip to content
Security
Command

/test-gen

Generate a Foundry test suite — happy path + edge cases + adversarial tests — for a contract or function.

From plugin
rugproof
1145 skills23 agents45 commands4 hooks
> /plugin marketplace add omermaksutii/RugProof
> /plugin install rugproof@rugproof

Command definition

test-gen.md
description: Generate a Foundry test suite — happy path + edge cases + adversarial tests — for a contract or function.
argument-hint: "<file-or-function>"
allowed-tools: Read, Write, Bash, Agent, Skill, mcp__forge-runner__*

/test-gen — generate a Foundry test suite

For `$ARGUMENTS` (a file, a contract, or a `Contract.function`), produce tests.

What it generates

For each public/external function:

1. **Happy-path test** — typical input, expected output. 2. **Boundary tests** — zero, max, off-by-one. 3. **Revert tests** — every `require` / `revert` path. Use `vm.expectRevert("...")`. 4. **Access-control tests** — call from unauthorized actor, expect revert. 5. **Reentrancy tests** — for any function with external calls, attempt reentrancy from a malicious receiver. 6. **Adversarial tests** — based on findings from `/audit` if available.

For state machines, also generate sequence tests:

function test_DepositThenWithdraw() public { ... }
function test_DepositThenLiquidateThenWithdraw_reverts() public { ... }

Procedure

1. Read the contract. 2. Enumerate functions and their semantic behavior. 3. For each function, generate the test set as above. 4. Generate any helper contracts needed (mock tokens, malicious receivers). 5. Run `forge test` via the MCP. Iterate on failures until all pass.

Output

test/generated/<Contract>.t.sol     — main test file
test/generated/mocks/<Mock>.sol     — mock contracts
test/generated/attackers/<Bad>.sol  — adversarial contracts

forge test result: 47 passing, 0 failing, 1.2s
Coverage: 91% lines, 84% branches

Notes

  • Tests must be runnable (`forge test`) and pass.
  • Don't generate tests for inherited OZ functions unless they're overridden.
  • Don't generate redundant tests — one good revert test per branch beats five for the same branch.
Read more
@omermaksutii
Ships withrugproof

Rugproof your code before someone else does. 🌐 Live site: omermaksutii.github.io/RugProof 📦 Latest: v1.0.0 — 45 commands · 23 agents · 45 skills · 13 MCP servers · tested, offline-first, with rule packs, a benchmark, non-EVM coverage, and post-deploy

1152 skills23 agents
Get the whole plugin

Stars on GitHub

Momentum

stars in total
11
Star history of omermaksutii/RugProof on GitHub, a chart by star-history.com

Other commands on rugproof.

audit-deep

audit-deep

Command

Deep audit — same as /audit but spawns more parallel subagents, runs multi-pass review, and chases exploit chains across files.

@omermaksutii@omermaksutiiInstall Command
audit-deps

audit-deps

Command

Audit third-party dependencies — resolve installed versions, cross-reference known-vulnerable releases, and flag vendored code…

@omermaksutii@omermaksutiiInstall Command
audit-diff

audit-diff

Command

Diff two Rugproof audit reports (before vs after) to track regressions — what's new, what's fixed, and whether the grade moved.

@omermaksutii@omermaksutiiInstall Command
audit-history

audit-history

Command

Pull past public audits (Code4rena, Sherlock, Spearbit, etc.) for a deployed contract or known protocol.

@omermaksutii@omermaksutiiInstall Command
audit-live

audit-live

Command

Audit a deployed contract on a live chain. Pulls verified source from the block explorer, optionally forks the chain for…

@omermaksutii@omermaksutiiInstall Command

More commands from other plugins.

deslop-reborn

deslop-reborn

Command

One iteration of the IronClaw Reborn de-slop loop — take ONE Reborn crate, fan out parallel review sub-agents (thermo-nuclear…

@nearai@nearaiInstall Command
audit

audit

Command

Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…

@trailofbits@trailofbitsInstall Command
arsenal

arsenal

Command

Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…

@awarexone@awarexoneInstall Command