test: reject invalid --fail-on severity before scanning

CHANGELOG.md

@@ -7,6 +7,7 @@ All notable changes to this project are documented here, following
 
 ### Added
 
+- Test coverage for rejecting invalid `--fail-on` severity values at the CLI.
 - **SKILL-SEC-006**: flag TLS verification disabling (`NODE_TLS_REJECT_UNAUTHORIZED=0`,
   `curl -k` / `--insecure`, `wget --no-check-certificate`, `verify=False`,
   `ssl._create_unverified_context`, `rejectUnauthorized: false`).

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@royalpinto007/skill-audit",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Security scanner for agent skills. Scan a Claude/agent Skill for prompt-injection, dangerous shell, secret access, and exfiltration before you trust it. Zero dependencies, SARIF output, npx skill-audit <path>.",
   "type": "module",
   "bin": {

test/skill-audit.test.js

@@ -12,6 +12,17 @@ import { RULES } from "../src/rules.js";
 const here = dirname(fileURLToPath(import.meta.url));
 const fixture = (n) => join(here, "fixtures", n);
 
+test("CLI rejects invalid --fail-on severity before scanning", () => {
+  const cli = join(here, "..", "bin", "skill-audit.js");
+  const clean = fixture("clean-skill");
+  for (const args of [["--fail-on", "severe", clean], ["--fail-on=CRITICAL", clean]]) {
+    const result = spawnSync(process.execPath, [cli, ...args], { encoding: "utf8" });
+    assert.equal(result.status, 2, `${args.join(" ")}: ${result.stderr}`);
+    assert.match(result.stderr, /unknown --fail-on/i);
+    assert.equal(result.stdout, "");
+  }
+});
+
 test("CLI rejects unknown options before scanning", () => {
   const cli = join(here, "..", "bin", "skill-audit.js");
   for (const args of [["--output", "report.json"], ["--output=report.json"], ["-x"]]) {