Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Bulugulu/game-qa --skill bootstrap-game-qa-systemgit clone --depth 1 https://github.com/Bulugulu/game-qaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bulugulu/game-qa/bootstrap-game-qa-system)<a href="https://agentmods.dev/skills/bulugulu/game-qa/bootstrap-game-qa-system"><img src="https://agentmods.dev/badge/skills/bulugulu/game-qa/bootstrap-game-qa-system/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bulugulu/game-qa/bootstrap-game-qa-system"><img src="https://agentmods.dev/badge/skills/bulugulu/game-qa/bootstrap-game-qa-system.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.01762 |
| Opus 5 | $0.00028 | $0.00881 |
| Sonnet 5 | $0.00011 | $0.00352 |
| Haiku 4.5 | $0.00006 | $0.00176 |
Grade A, and why
bootstrap-game-qa-system scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 104 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bootstrap Game QA System
You are setting up game-qa infrastructure for a browser-game project. The plugin ships three reference artifacts you'll copy and adapt:
references/runner.ts— project-agnostic runner (copy as-is, do not modify)references/qa-adapter.template.ts— adapter skeleton (copy and fill in)references/journey-schema.md— YAML contract the runner consumes (don't copy; engineers read this to author journeys)
The seam: the runner is framework-fixed, the adapter is project-specific. If you need new behavior, add a primitive to the adapter or extend the journey schema — never fork the runner.
Run once per project. If parts exist, gap-fill — don't rebuild.
The Iron Law
GAME PROJECTS ONLY.
RUN ONCE. GAP-FILL, DON'T REPLACE.
ARRANGE/PROBE PRIMITIVES ONLY — NEVER ACTIONS-UNDER-TEST.
What to Build (in order)
-
Debug system. An action registry (server-authoritative for multiplayer projects; client-side for single-player), reflection-driven catalog (
debug.help()),window.debug.<action>proxy on the client,[debug-ready]+[debug-event]console contract. If the project has these, verify and move on. If not, build the minimum: awindow.debugobject exposing project actions, plus a one-shotconsole.log("[debug-ready]")once it's wired. -
Drop the runner. Copy
references/runner.tsto<project>/qa/runner.ts. Start unmodified. The runner is extensible — add newperform:types orcapture: at:kinds as your game needs them (see "Extending the framework" below) — but don't silently change existing semantics. If your project is plain JS, run viatsx/ts-node/vite-node, or strip type annotations after copy. The runner imports./adapter.ts— the next step creates it. -
Adapt the adapter. Copy
references/qa-adapter.template.tsto<project>/qa/adapter.ts. Then fill in:url— your project's dev URLreadyMarker— the console string your project emits whenwindow.debugis wiredhudSelector— optional CSS selector for the HUD if you wantcapture: at: [hud]to workarrange.*— wrappers around yourwindow.debug.*for state setup (see arrange-vs-shortcut discipline below)probe.*— wrappers for read-only state queries; always includesnapshotas the default fallbackevents.subscribe/events.drain— wire to your project's event source (DOM events, EventEmitter, WebSocket messages, etc.)reset— idempotent between-journey resetclearByTag— sweep entities this runner created (use thespawnTrackerpattern in the template)
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 104 lines · 56 tokens per session scan A 6edbbe0c39fd
bootstrap-game-qa-system is a skill published in the GitHub repository Bulugulu/game-qa (1 stars, last pushed 3mo ago), licensed MIT. It adds 56 tokens to every session and 1,762 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
smoke-check
Run the critical path smoke test gate before QA hand-off. Executes the automated test suite, verifies core functionality, and produces a PASS/FAIL report. Run after a sprint's stories are implemented and before manual QA begins. A failed smoke check means the build is not ready for QA.
hearth-playtest
Let the engine hunt bugs for you — bot playtesting via hearth sweep. Seeded bot policies (mash/idle/wander/seek) play a scene headlessly across many seeds and report softlocks, crashes, stuck states, and unmet objectives as a compact evidence report; objectives double as executable acceptance criteria; a failing seed…
game-playtesting
Test a game end to end like a player across boot, controls, gameplay loops, UI, save state, failure recovery, rendering, audio, performance, and platform behavior. Use after game implementation or for regression investigation.
gm-evaluate
Evaluate the current tag's quality: enforce the playable-closed-loop gate, maintain a single cross-tag e2e/ suite that always reflects the current game (add tests for new mechanics, prune tests for mechanics this tag deliberately removed), and reason about gameplay quality. Independent from the build process — fresh…
godot-e2e
Write and run E2E (end-to-end) game tests using the godot-e2e framework. Python controls a live Godot game over TCP — Locator-based semantic queries, expect() auto-retry assertions, and engine log capture make failures self-diagnosing. Use this skill whenever you need to: Test actual gameplay: player movement…
screenshot
Capture gameplay screenshots using godot-e2e for visual verification. Use when you need to: take a screenshot of the running game, capture multiple screenshots during an E2E scenario, generate reference.png, visually verify game state, or provide screenshots for VQA analysis. Triggers: "screenshot", "capture…