Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/c9r-io/orchestrator/qa-testingnpx skills add c9r-io/orchestrator --skill qa-testinggit clone --depth 1 https://github.com/c9r-io/orchestratorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/c9r-io/orchestrator/qa-testing)<a href="https://agentmods.dev/skills/c9r-io/orchestrator/qa-testing"><img src="https://agentmods.dev/badge/skills/c9r-io/orchestrator/qa-testing.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00023 | $0.03411 |
| Opus 5 | $0.00012 | $0.01706 |
| Sonnet 5 | $0.00005 | $0.00682 |
| Haiku 4.5 | $0.00002 | $0.00341 |
Grade A, and why
qa-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 353 lines — stays where its author put it; the contents beside it link to each section on GitHub.
QA Testing Skill
Execute scenario-based QA testing driven by docs/qa/**/*.md documents.
Prerequisites
CRITICAL: Always rebuild CLI before testing to ensure you have the latest version.
-
Rebuild CLI (REQUIRED - ensures latest code):
cargo build --release -p orchestrator-cli -p orchestratord -
Initialize orchestrator if needed — only when the database does not exist yet:
# `orchestrator init` is only for a genuinely absent runtime database. # The default runtime root is ~/.orchestratord; ORCHESTRATORD_DATA_DIR overrides it. orchestrator daemon status -
For QA scenario isolation — use project-scoped reset instead of destroying shared state:
# Delete a project's state (task data + config + auto-tickets) orchestrator delete project/<project> --force # Deploy fixtures into project scope (other projects untouched) orchestrator apply -f fixtures/manifests/bundles/<fixture>.yaml --project <project> -
QA docs exist under
docs/qa/. -
Optional: UI automation via browser tools.
Conventions / Configuration
API helper script: .claude/skills/tools/qa-api-test.sh
Environment variables:
API_BASE_URL(default:http://localhost:8080)API_TOKEN(optional)API_TOKEN_CMD(optional command that prints a token to stdout)
Notes:
- If the API does not require auth, omit
API_TOKENandAPI_TOKEN_CMD. - If the API requires auth, prefer providing a project-specific
API_TOKEN_CMD(for example, a script underscripts/).
Test Scripts Directory (scripts/qa/)
IMPORTANT: A collection of reusable QA test scripts may exist in scripts/qa/. Before writing any new test script, always check scripts/qa/ first for an existing script that covers the same or similar scenario.
- Reuse first: Run
ls scripts/qa/orGlob: scripts/qa/*to find existing scripts. If a matching script exists, use it directly (or adapt it) instead of creating a new one. - Create in
scripts/qa/: When a new test script is needed, always place it underscripts/qa/— never in the project root or other ad-hoc locations. - Naming convention: Follow existing patterns — e.g.,
test-{feature}.{js,mjs,py,sh}or{feature}_test.py.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 353 lines · 23 tokens per session scan A 0fd90f7d9094
qa-testing is a skill published in the GitHub repository c9r-io/orchestrator (21 stars, last pushed 3d ago), licensed MIT. It adds 23 tokens to every session and 3,411 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
webapp-testing
Start/reuse a local app, wait for readiness, inspect rendered state/console/network, act from observed selectors, and verify with evidence.
tutti-workspace-app-factory
Create, convert, or repair one Tutti workspace app as either a self-contained publishable package under package/ or a Chrome-style local debug app under .tutti/dev-app/. Use for mention://workspace-app-factory/create handoffs, mention://workspace-app-factory handoffs, standalone app generation, adapting existing…
tutti-record-agent-session-replay
From a Tutti checkout, run, audit, freshly replay, publish, or diagnose Session Replay cassettes that are driven by case-repository scenario scripts (CDP), not by interactive UI recording. Use for real-Provider capture while a scenario.mjs executes, cassette transport or semantic-state mismatches, fresh replay…
qa
Browser-based QA verification. Launches a real browser, navigates the app, clicks buttons, fills forms, and tests user flows. Works as a standalone skill or as a phase end condition in campaigns. Requires Playwright (optional dependency, graceful skip if not installed).
browser-tools
Security wrapper over the upstream agent-browser skill, adding URL blocklisting, rate limiting, robots.txt enforcement, and scraping guardrails. Use when automating browser workflows that need safety limits.
browser
Browser automation via the agent-browser CLI. Use when the user needs to drive websites or Electron desktop apps — navigating, filling forms, clicking, screenshots, extracting data, testing web apps, visual UI checks, the Pi Dashboard's Electron shell, or the user's own logged-in browser (SSO/2FA sites). Triggers…