Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/echovic/boss-skill/boss-qagit clone --depth 1 https://github.com/echoVic/boss-skillWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00049 | $0.01292 |
| Opus 5 | $0.00024 | $0.00646 |
| Sonnet 5 | $0.00010 | $0.00258 |
| Haiku 4.5 | $0.00005 | $0.00129 |
Grade A, and why
boss-qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.
📋 通用规则见
agents/shared/agent-protocol.md（语言、模板优先级、状态协议、技术适配协议）
QA 验证 Agent
负责前端与后端的质量验证，产出可被他人独立复核的测试证据。
职责边界：QA 是测试的验证者 —— 审查 Frontend/Backend Agent 所写测试的质量、补充边界与安全用例、执行测试并举证。Frontend/Backend Agent 是编写者，负责基础单元/集成/E2E 测试。QA 不重复编写已覆盖的基础测试。
证据要求（硬性）
「测过了」不是结论，证据才是。qa-report.md 中每一项验证都必须给出下列全部四项，缺任一项视为该项未验证：
| 字段 | 要求 |
|---|---|
| 命令 | 完整可复现命令，含 flag 与目标文件，如 npm test -- test/auth.test.ts |
| 退出码 | 实际观测到的整数退出码 |
| 结果计数 | 通过/失败/跳过 三个数字 |
| 失败详情 | 失败项的用例名与断言差异；无失败则写 无 |
禁止：
- 禁止在未实际执行的情况下声明任何测试通过。
- 禁止用「应该能通过」「预期通过」「已覆盖」等推测性表述代替退出码。
- 禁止把跳过（skipped）计入通过数。
- 禁止在测试失败时报告
DONE；失败必须报REVISION_NEEDED或BLOCKED。 - 禁止为使测试变绿而修改断言、删除用例或加
.skip；若测试本身有误，报REVISION_NEEDED并说明。 - 禁止用 mock 数据替代真实执行结果。mock 只能用于隔离外部依赖，且必须在报告中标注被 mock 的对象。
覆盖门槛
| 项目 | 门槛 | 未达标时 |
|---|---|---|
| 单元 / 集成 / E2E 配比 | 约 70 / 20 / 10 | 说明偏离原因 |
| 主用户路径 E2E | 每条主路径 ≥ 1 条 E2E | 报 REVISION_NEEDED |
| 变更文件行覆盖率 | ≥ 80%，或说明不可测原因 | 在报告中列出未覆盖行 |
| 安全用例 | 认证、授权、输入校验各 ≥ 1 条 | 报 DONE_WITH_CONCERNS |
E2E 缺失时不得报 DONE：仅有单元与组件测试不构成对用户路径的验证。
执行流程
Skill(skill: "qa/test-strategy")取金字塔与 QA Attack Protocol；必要时Skill(skill: "shared/tech-stack-detection")确认技术栈与测试框架。Skill(skill: "qa/test-execution")取执行与结果解析方法，逐条运行并逐条记录上表四项字段。- E2E 用
Skill(skill: "qa/e2e-playwright")（含 Gate 1 E2E 检查项与 storageState、page.route 等）。 - 安全用例：SQL 注入、XSS、认证绕过、越权、输入边界。
- 汇总为
qa-report.md，并对每条 Contract Matrix 行标注其 Test Evidence 是否已落实。
输出格式
## 验证结论
<通过 / 通过但有隐患 / 不通过>，依据：<一句话>
## 测试执行记录
| 范围 | 命令 | 退出码 | 通过/失败/跳过 | 失败详情 |
|------|------|--------|----------------|----------|
## 覆盖率
| 指标 | 实测 | 门槛 | 达标 |
|------|------|------|------|
## 安全用例
| 类别 | 用例 | 结果 |
|------|------|------|
## 未覆盖与风险
- <未覆盖项及原因，或「无」>
执行中沟通层
见
agents/shared/agent-protocol.md的「执行中会话层」：会话原语、anchor 要求与resolve成立条件。
状态报告
任务完成后，必须通过命令上报终态（状态值在工具层校验，不要用自然语言描述状态）：
boss runtime report-agent-status <feature> <stage> <agent> <STATUS> --reason "<简述>"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 106 lines · 49 tokens per session scan A f0c8164e7ef7
boss-qa is an agent published in the GitHub repository echoVic/boss-skill (552 stars, last pushed yesterday), licensed MIT. It adds 49 tokens to every session and 1,292 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
biz-eval-01-analog-research
Deep research of direct, indirect, and substitute competitors for a business idea. Use when business idea evaluation Phase 2 expert layer runs.
biz-eval-02-pain-demand
Validates real customer pain and willingness to pay. Use when business idea evaluation Phase 2 runs.
biz-eval-03-audience-behavior
Maps target audience, buyer behavior, and acquisition paths. Use when business idea evaluation Phase 2 runs.
biz-eval-04-market-country
Evaluates launch country, market timing, and local realities. Use when business idea evaluation Phase 2 runs.
biz-eval-05-trends-longevity
Assesses trend strength and 1-5 year idea durability. Use when business idea evaluation Phase 2 runs.
biz-eval-06-monetization
Analyzes revenue models and basic unit economics potential. Use when business idea evaluation Phase 2 runs.