From 966324177f79499de7a3996a8992b1da130d71e3 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sat, 12 Sep 2026 02:05:43 +0000
Subject: [PATCH] test: reject invalid --fail-on severity at CLI

Add coverage for malformed --fail-on values (wrong spelling and wrong
case). Fixes AgentPostmortem/Skill-audit#2.

Co-authored-by: Sharad. <sharadvc@users.noreply.github.com>
---
 CHANGELOG.md             |  6 ++++++
 package.json             |  2 +-
 test/skill-audit.test.js | 11 +++++++++++
 3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3a8ab56..3479b02 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,12 @@
 All notable changes to this project are documented here, following
 [Keep a Changelog](https://keepachangelog.com/) and semantic versioning.
 
+## [0.1.7] - 2026-09-12
+
+### Added
+
+- Test coverage for rejecting invalid `--fail-on` severity values at the CLI.
+
 ## [0.1.6] - 2026-09-11
 
 ### Fixed
diff --git a/package.json b/package.json
index 9106aec..117b5ea 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@royalpinto007/skill-audit",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Security scanner for agent skills. Scan a Claude/agent Skill for prompt-injection, dangerous shell, secret access, and exfiltration before you trust it. Zero dependencies, SARIF output, npx skill-audit <path>.",
   "type": "module",
   "bin": {
diff --git a/test/skill-audit.test.js b/test/skill-audit.test.js
index f4d8b3e..2bd79ba 100644
--- a/test/skill-audit.test.js
+++ b/test/skill-audit.test.js
@@ -12,6 +12,17 @@ import { RULES } from "../src/rules.js";
 const here = dirname(fileURLToPath(import.meta.url));
 const fixture = (n) => join(here, "fixtures", n);
 
+test("CLI rejects invalid --fail-on severity before scanning", () => {
+  const cli = join(here, "..", "bin", "skill-audit.js");
+  const clean = fixture("clean-skill");
+  for (const args of [["--fail-on", "severe", clean], ["--fail-on=CRITICAL", clean]]) {
+    const result = spawnSync(process.execPath, [cli, ...args], { encoding: "utf8" });
+    assert.equal(result.status, 2, `${args.join(" ")}: ${result.stderr}`);
+    assert.match(result.stderr, /unknown --fail-on/i);
+    assert.equal(result.stdout, "");
+  }
+});
+
 test("CLI rejects unknown options before scanning", () => {
   const cli = join(here, "..", "bin", "skill-audit.js");
   for (const args of [["--output", "report.json"], ["--output=report.json"], ["-x"]]) {