Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add akovalion/paranoid-qa --skill bug-reportgit clone --depth 1 https://github.com/akovalion/paranoid-qaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/akovalion/paranoid-qa/bug-report)<a href="https://agentmods.dev/skills/akovalion/paranoid-qa/bug-report"><img src="https://agentmods.dev/badge/skills/akovalion/paranoid-qa/bug-report/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/akovalion/paranoid-qa/bug-report"><img src="https://agentmods.dev/badge/skills/akovalion/paranoid-qa/bug-report.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium analysis-evasion · line 1 Suspicious Unicode normalization or mixed-script contentFix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00041 | $0.01970 |
| Opus 5.5 | $0.00016 | $0.00788 |
| Sonnet 5.5 | $0.00008 | $0.00394 |
| Haiku 4.5 | $0.00004 | $0.00197 |
Grade A, and why
bug-report scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 116 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ты помогаешь быстро завести баг в Jira. Работай по этому алгоритму:
0. Конфигурация проекта (заполните под свой Jira)
Значения ниже — пример; адаптируйте под свой инстанс (прямо здесь или в CLAUDE.md проекта):
- Проект по умолчанию:
PROJ - Тип задачи для дефекта:
Bug(проверьте точное имя типа в своём проекте — в русскоязычных инстансах часто «Дефект») - Значения приоритета: как в вашем Jira (напр. Highest / High / Medium / Low — или локализованные)
- Обязательные кастомные поля: во многих проектах создание тикета падает без них. Пример формата:
customfield_XXXXX(Team):"..."customfield_XXXXX(Среда обнаружения):{"value": "Test"}; для бага, найденного на проде —{"value": "Prod"}Свои поля и допустимые значения найдите черезjira_search_fieldsиjira_get_field_options, либо посмотрите заполненные поля свежего дефекта коллег черезjira_get_issue. Две частые ловушки. Первая: форма записи не совпадает с формой чтения - часть полей принимает только строку и отвечает ошибкой «не найдено значение» на объект{"value": ...}, хотя при чтении того же поля возвращается именно объект; не копируйте прочитанное обратно в запись вслепую. Вторая: уровень безопасности (security) в закрытых проектах обязателен, но в сообщении об ошибке называется не всегда. Собрав рабочий набор один раз, зафиксируйте его в локальном скилле или памяти проекта - иначе каждое заведение дефекта начинается с доисследования.
1. Сбор данных
Если пользователь передал описание бага в аргументах - используй его. Если нет - задай вопросы через AskUserQuestion:
Обязательные данные:
- Что произошло (фактический результат)
- Что ожидалось (ожидаемый результат)
- Шаги воспроизведения
- Окружение (стенд, браузер, устройство)
- Место: URL, блок или элемент (видимым признаком), где воспроизводится и где нет (другие страницы того же типа, браузеры, вьюпорты). Обобщение «везде» - только после проверки каждого места, иначе «проверено на A и B». В описании место идёт в шаги (URL) и фактический результат (блок, где есть и где нет)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +2 lines a51a7a40fe8e
- 12d ago Changed · +7 lines 94ba2a47b527
- 15d ago Changed · +1 lines cc3eb4c1f864
- 1mo ago First seen · 106 lines · 41 tokens per session scan A bcebad99d7b5
bug-report is a skill published in the GitHub repository akovalion/paranoid-qa (16 stars, last pushed yesterday), licensed MIT. It adds 41 tokens to every session and 1,970 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
test-plan
Build a test plan when a new Epic is created. Pulls epic details and linked stories from Jira, analyzes scope, and produces a test plan covering strategy, automation gap analysis, success criteria, environment needs, and risks. Output goes to Confluence and local test knowledge base. Use when: "test plan", "plan tests…
review-ticket
Review a Jira ticket during backlog grooming or refinement. Audits the ticket for testability, AC completeness, missing edge cases, and potential blockers. Outputs a structured review the SDT can bring to the grooming session. Use when: "review this ticket", "check ACs", "testability review", "grooming". Do NOT use…
setup
First-run configuration wizard for QABuddy. Sets up context source (Jira, spec docs, chat, custom), team mode (solo vs PR-based), and project preferences. Writes .qabuddy.json to the project root. Re-run to reconfigure. Use when: "setup", "configure", "first time setup", "change settings". Do NOT use when: asking…
mk:qa
Systematically QA test a web application and fix bugs found. Runs QA testing, then iteratively fixes bugs in source code, committing each fix atomically and re-verifying. Use when asked to "qa", "QA", "test this site", "find bugs", "test and fix", or "fix what's broken". Proactively suggest when the user says a…
feature-prioritisation
Aplica marcos de priorización (RICE, MoSCoW, Kano, ICE, Opportunity Scoring) para clasificar características e items del backlog. Úsalo cuando se te pida priorizar características, clasificar un backlog, decidir qué construir a continuación, o evaluar compensaciones entre ideas competidoras. Produce una lista de…
design-handoff-brief
Transform feature briefs into structured design briefs that give designers the context they need before opening Figma. Use when asked to write a design brief, create a design handoff, brief a designer on a new feature, or translate a PRD into design requirements. Produces a brief with user goal, emotional context…