Code Review

No blocking issues found. This is a clean, low-risk PR that adds missing skill bundle entries and improves testing documentation.

What was reviewed

• skill_assets.ts: New BUNDLED_SKILLS entries follow the existing { relativePath, name } pattern exactly. All referenced files verified to exist on disk.
• testing.md updates: Four extension skill testing docs updated with withMockedFetch, withMockedCommand, and local mock server patterns. Documentation is well-structured and consistent across all four skills.
• No libswamp import boundary violations — changes are in the infrastructure layer and skill documentation only.
• No security concerns — static array additions and markdown documentation.
• AGPLv3 header present on skill_assets.ts.

Suggestions

1. The swamp-extension-vault entries in BUNDLED_SKILLS could be grouped closer to the other swamp-vault entries for readability, but they're already adjacent so this is minor.

LGTM — ship it.

Adversarial Review

Critical / High

None.

Medium

None.

Low

1. .claude/skills/swamp-extension-datastore/references/testing.md:82-86 — The S3 mock server example sets AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as environment variables and deletes them in finally, but AWS_SECRET_ACCESS_KEY is not deleted in the finally block (only AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are deleted — wait, on re-read both are deleted, this is fine). No issue here actually.

2. .claude/skills/swamp-extension-vault/references/testing.md:87 — The AWS mock server example's finally block deletes AWS_ENDPOINT_URL but not AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY. Similarly, the datastore and driver testing docs have the same pattern in their AWS examples. Since these are documentation examples (not executable code), this is cosmetic, but users copying the pattern could leak test env vars to subsequent tests. Unlikely to cause real issues since these are fake creds in test contexts.

3. Documentation-only concern — The vault testing doc removed the createVaultTestContext usage example (the in-memory test double section) in favor of mock primitive docs. The function still exists and is exported from @systeminit/swamp-testing. Users looking for "how to create an in-memory vault for consumer tests" now have less guidance in this skill doc, though the README in the testing package still covers it. Minor discoverability regression.

Verdict

PASS — Straightforward data additions to BUNDLED_SKILLS (all referenced files verified to exist on disk) and documentation updates adding mock primitive guidance. No logic changes, no security concerns, no breaking changes.